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ABSTRACT 


This  thesis  introduces  a  program  that  analyzes  network  protocols  using  the 
Communicating  Finite  State  Machines  (CFSM)  model  and  the  System  of  Commumcating 
Machines  (SCM)  model.  A  simple,  two  machine  implementation  of  CFSM  model  is 
initially  explored.  A  number  of  simple  protocols  are  demonstrated  as  a  means  to  validate 
the  automated  tool  (program). 

The  second  model  implemented  is  that  of  the  SCM  model.  The  SCM  tool  uses  many 
of  the  same  data  stmetures  designed  in  the  CFSM  program .  The  SCM  program  is  validated 
with  an  analysis  of  widely  used  data  link  protocols. 

Both  programs  were  done  in  the  Ada  language  environment 
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L  INTRODUCTION 


“  simulations  are  set  up  to  answer  the  question,  what  if...” 

-Hamming,  R.  W.,  Future  Engineering  Practice 
Course  Notes,  11  May  92. 


A.  BACKGROUND 

The  past  ten  years  have  seen  an  substantial  increase  in  the  need  to  communicate 
quickly  and  reliably  over  long  distances  using  a  wide  range  of  architecmres.  We,  the  users, 
live  in  a  ‘come  as  you  are’  digital  society.  Access  to  some  sort  of  network  is  needed  to  move 
information  from  user  to  user.  This  movement  of  information  takes  place  on  many 
networks  (voice,  message,  data)  and  at  many  levels  (physical,  data  link,  network,  and 
higher).  The  networks  in  use  today  tend  to  be  a  heterogeneous  mix  of  equipment  and 
protocols.  We,  the  network  designers/engineers,  must  allow  the  user  access  to  the  available 
resources  at  the  lowest  cost.  To  do  this  a  firm  understanding  of  how  machines  ‘handsh'ake’ 
and  talk  to  one  another  must  be  realized.  This  is  accomplish  by  applying  protocol  design 
principles.  These  principles  can  be  applied  to  protocols  and  studied  using  a  wide  range  of 
Formal  Description  Techniques  (FDT’s).  Examples  of  existing  FDT’s  will  be  reviewed  and 
the  need  for  an  automated  set  of  tools  will  also  be  explored. 

The  need  for  machines  to  be  able  to  communicate  is  inherent  in  any  heterogenous 
environment.  Machines  do  this  through  the  use  of  standardized  protocols.  A  protocol  is  a 
set  of  rules  that  govern  the  interaction  of  concurrent  processes  in  distributed  systems. 
Another  widely  used  definition  of  a  protocol  is,  a  set  of  rules  used  for  communication 
between  two  or  more  processes  connected  by  a  communication  network.  Hand  in  hand, 
protocol  design  and  analysis  is  an  important  consideration  in  operating  systems,  computer 
networks,  and  data  communications.  For  a  protocol  designer/architect  to  build  an 
appropriate  specification,  he  must  use  one  of  a  number  of  modeling  techniques. 
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Mcxlels  or  FDT’s  cf  protocols  are  used  for  many  purposes.  They  are  used  to  describe 
the  protocol  unambiguously  so  that  the  exact  operation  is  understood  by  both  the  protocol 
designer,  implementor  and  user.  A  model  is  also  used  to  provide  a  formal  framework  for  a 
rigorous  analysis  of  the  protocol  specification.  With  the  advent  of  internetworking  and  the 
birth  of  Integrated  Services  Digital  Network  (ISDN),  computer  protocols  have  become 
more  and  more  complex.  The  designer  must  now  develop  large  sets  of  rules  for  information 
exchange  that  is  logically  consistent  and  efficiently  implemented.  To  design  a  new  protocol 
or  to  implement  an  existing  one  into  a  computing  environment  gives  rise  to  a  need  for  such 
a  tool. 

There  are  many  formal  models  available  to  protocol  architects.  Some  of  the  more 
common  models  include  Petri  Nets,  Communicating  Processes,  Communicating  Finite 
State  Machines  (CFSM),  System  of  Communicating  Machines  (SCM),  the  Language  of 
Temporal  Ordering  Specifications  (LOTOS),  Specification  and  Description  Language 
(SDL),  and  Extended  State  Transition  Model  Language  (ESTELLP).  LOTOS  and 
ESTELLE  are  formal  description  techniques  developed  by  the  International  Organization 
for  Standardization  (ISO)  working  laterally  with  the  International  Telephone  and 
Telephone  Consultative  Committee  (CCITT). 

The  ISO  is  a  standards  publishing  body  including  the  American  National  Standards 
Institute  (ANSI).  In  1980,  the  ISO  saw  the  advantages  of  standardizing  a  hierarchy  of 
protocol  services  as  a  reference  model  for  protocol  designers.  The  model  includes  seven 
layers;  physical,  data  link,  network,  transfwrt,  session,  presentation,  and  application.  The 
layer/class  of  protocols  that  will  be  analyzed  in  this  thesis  are  the  data  link  layer  protocols. 

Each  of  the  models  that  will  be  discussed  have  a  means  to  amplify  design  principles 
of  communications  systems[BART  87].  The  first  principle  is  for  a  model  to  reflect  the 
behavior  of  the  protocol.  Behavior  is  modeled  using  conformance  models,  an  example 
found  in  [RAND  92].  Secondly,  the  model  must  allow  refinement  by  the  user.  Safety  and 
lively  properties  should  be  proven  true.  And  the  last  principles  that  must  be  supported  are 
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those  of  concurrency  and  nondeterminism.  A  good  overview  is  found  in  King’s 
article[KING  91]. 

The  need  for  a  variety  of  models  is  apparent  wiien  it  is  considered  that  the  interaction 
between  machines  occurs  at  different  levels  in  the  OSI  structure  and  that  behavior  can  be 
quite  different  among  levels  and  machines.  The  models  listed  above  will  be  reviewed  in  the 
following  section.  Most  of  the  models  have  a  means  to  informally  follow  the  design 
principles.  Upon  close  inspection  of  each  FDT  it  is  apparent  that  no  one  is  perfect  for  all 
applications.  As  such,  an  automated  tool  will  be  presented  that  will  make  the  use  oi  two 
models  (CFSM  and  SCM).  The  intuitive  feel  of  each  protocols  coupled  with  the  power  of 
automating  such  a  such  models  will  enable  the  user  to  fully  enjoy  the  important  design 
principle  of  refinement. 

B.  OBJECTIVES 

The  objective  of  this  thesis  is  to  present  a  means  of  automating  two  powerful  models 
of  protocol  validation  and  analysis.  The  first  that  was  to  be  automated  is  the  CFSM  model. 
The  data  structures  and  program  entities  were  developed  and  verified.  The  second  tool 
automated  is  the  SCM  model.  Although  the  SCM  used  many  of  the  underlying  data 
structures  and  logic  of  the  CFSM,  the  SCM  model  is  much  more  elegant  and  much  more 
complex.  The  output  information  is  provided  to  the  user  in  an  intuitive  format.  Once  the 
two  models  were  fully  functional,  test  cases  were  input  to  the  models  to  verify  the 
functionality.  Finally,  a  select  number  of  existing  protocols  were  input  and  the  analysis 
compared  to  previous  research  using  a  manual  method. 

C.  SCOPE 

This  thesis  presents  automated  implementation  of  both  the  CFSM  and  SCM  models. 
The  implementation  of  each  model  was  limited  to  two  machine  protocols.  The 
specifications  covered  in  this  thesis  lend  themselves  very  well  to  the  simulation  or 
automated  analysis. 


3 


The  unboundedness  properties  of  CFSM  channels  are  obviously  limited  to  the 
hardware  that  the  tool  is  run  on.  A  channel  can  have  a  bound  the  size  of  the  largest  machine 
register,  in  the  case  of  the  test  runs,  a  SUN  SPARC  station,  the  upper  bound  was  that  of  the 
largest  integer(4.294967  x  lo’  items). 

An  analysis  of  select  data  link  protocols  are  included  to  illustrate  the  use  of  the  CFSM 
and  SCM  automated  models.  The  specifications  will  only  address  procedural  rules,  not 
formatting  of  messages. 

D.  ORGANIZATION 

This  thesis  is  organized  into  three  sections.  The  first  section  includes  Chapters  IT  and 
in.  Chapters  n  and  ni  give  background  information  of  pertinent  models  and  language 
considerations.  The  next  section.  Chapters  FV  and  V,  give  a  detailed  description  of  how  the 
code  was  implemented  to  reflect  the  behavior  of  the  two  models.  The  final  section.  Chapter 
VI,  describes  the  specifications  of  Alternating  Bit,  Go_Back_N,  and  Selective  Repeat 
network  protocols.  It  also  describes  how  the  user  inputs  the  information  into  and  receives 
output  from  the  tool.  A  means  for  validating  each  automated  model  is  discussed  in  this 
chapter.  Finally,  Chapter  VII  includes  conclusions  made  based  on  the  thesis  work  and 
recommendations  for  futiuo  work  in  the  area. 
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n.  BACKGROUND  OF  MODELS 


A.  GENERAL 

This  section  contains  an  overview  of  some  existing  FDT’s.  Each  model  is  a  different 
way  to  represent  a  protocol  design  or  reflect  network  behavior.  Each  has  its  own  inherent 
advantages  and  disadvantages,  of  which  must  be  considered  before  application.  Two 
models  listed  (ESTELLE  and  LOTOS)  are  automated. 

The  first  method  of  description  is  Petri  Nets.  Petri  Nets  are  a  graphical  representation 
of  a  systems’s  states  and  state  changes.  The  possible  states  are  captured  using  places  which 
can  hold  tokens.  A  particular  state  is  represented  by  a  movement  of  tokens  to  states.  State 
changes  are  described  using  transitions.  This  can  be  visualized  as  being  similar  to  a  directed 
graph.  The  input  and  output  arcs  associated  with  each  transition  determine  how  token 
placement  changes.  The  behavior  of  a  system  can  be  determined  by  examining  token 
movement  within  the  net.  Deadlock  and  freedom  of  livelock  are  examined  in  this  model. 
The  complexity  of  Petri  Net  representation  increases  with  the  size  of  the  protocol  being 
modeled.  A  major  consideration  for  using  this  model  is  the  intuitive  feel  of  a  protocol  is  lo'st 
on  the  complex  cases. 

Another  class  of  FDT  are  models  is  called  “communicating  processes.”  The  following 
description  is  more  closely  examined  in  Lundy’s  article[LUND  92b].  The  elimination  of  a 
set  of  global  states  is  done  through  the  use  of  invariants.  Rather  than  generating  the  set  of 
all  possible  states,  and  inspecting  them  to  be  sure  no  undesirable  state  exists,  an  assertion 
is  made.  The  assertion  states  the  desired  property.  It  is  proven  that  the  protocol  always 
satisfies  the  assertion,  this  must  be  proven  without  having  to  compute  all  the  possible  states 
which  might  be  reached.  The  communication  between  processes  takes  place  between 
unbounded  FIFO  queues.  Processes  are  emulated  by  use  of  variables  and  statements.  The 
execution  of  an  action  is  an  atomic  event  and  no  two  actions  may  occur  simultaneously. 
Since  communication  between  processes  can  only  occur  using  FIFO  queues,  actions  may 
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only  follow  a  given  sequence.  The  SCM  model  demonstrates  how  this  is  characteristic  is 
overcome. 

Extended  State  Transition  Model  Language  (ESTELLE)  can  describe  a  system  in 
terms  of  a  set  of  communicating  extended  finite  state  machines  through  use  of  FIFO 
channels,  similar  the  to  definition  of  CFSM.  This  model  describes  the  protocols  as  a 
collection  of  modules,  each  module  is  an  extended  FSM  having  memory-the  difference 
between  an  CFSM  and  Estelle  model  is  that  the  CFSM  model  has  no  memory.  Modules  of 
an  entity  can  communicate  through  FIFO  channels[SARI  91].  Messages  are  exchanged 
between  entities  as  parameters  to  the  modules.  Estelle  is  bajcd  on  Pascal  and  the  extension 
of  the  language  is  a  feature  available  to  the  programmer/user.  The  models  automated  in  this 
thesis  are  similar  to  Estelle,  however,  data  representation  is  implemented  differendy  and 
the  power  of  the  hmguage  implemented  (ADA)  is  udlizedESTELLE  also  allows  dynamic 
module  creation/destruction  and  transidon  priorides.  A  model  implementadon 
consideration  is  ESTELLE  cannot  adequately  represent  broadcast  channels,  a  shortcoming 
that  the  SCM  model  has  shown  very  well  suited  for,  such  as  CMSA/CD  analysis  [LUND 
91a]. 

Specificadon  and  Description  Language  was  designed  and  implemented  by  groups 
SGXI  and  SGX  of  the  CCITT.  It  was  meant  as  a  tool  for  the  design  and  specification  of 
telephone  switches  and  their  underlying  protocols.  Currendy  there  are  two  versions  of 
SDL;  a  graphical  tool  and  a  text  program  tool.  Processes  are  represented  by  flowcharts, 
which  could  be  concurrent  to  other  processes.  The  eight  traditional  flowchart  symbols 
represent  atomic  actions  such  as  internal  events,  input  and  output,  boolean  expressions, 
wait  conditions,  statements,  transitions,  and  connectors  Each  flowchan-  has  an  associated 
channel  (queue)  used  to  process  messages.The  Holzman  text  [HOLZ  91]  includes  a  more 
specific  definition  of  SDL  with  some  examples.  One  advantage  to  this  approach  is  the  user 
gets  a  feel,  graphically,  of  the  behavior  of  the  protocol.  The  process  execution  is  somewhat 
restricted  to  the  properties  that  a  FIFO  queue  has. 
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The  ISO  language  of  Temporal  Ordering  Specifications  (LOTOS)  is  means  of 
representation  using  hierarchically  structured  processes.  As  with  ESTELLE,  LOTOS  was 
also  developed  by  the  ISO.  A  hierarchy  of  processes  can  correspond  to  one  entity[SIST  91]; 
a  concept  that  is  reflected  in  object-oriented  design  environments.  Systems  represented 
using  this  model  are  organized  using  a  set  of  interacting  processes  which  exchange 
information  with  each  other  and  with  the  external  systems  environment  through  gates. 
LOTOS  is  a  superset  language  consisting  of  an  abstract  data  type  language  and  an  algebraic 
notation  language,  both  of  which  uphold  good  design  principles  covered  earlier.  Interaction 
is  synchronous  through  gates  that  have  a  one-to-one  mapping  to  interaction  points. 

The  tool  implemented  in  this  thesis  uses  the  technique  of  representing  portions  of 
machine  behavior  as  abstract  data  types,  as  demonstrated  using.  A  technique  of  interpreting 
machine  behavior  through  use  of  finite  state  machine  representation,  as  with  ESTELLE, 
will  also  be  integrated  into  the  design.  Plans  for  future  upgrade  of  this  tool  include  a 
graphical  interface  similar  to  that  of  SDL. 

B.  COMMUNICATING  FINITE  STATE  MACHINES 

One  of  the  first  manual  tools  used  for  analyzing  communication  protocol  behavior  was 
the  communicating  finite  state  machine(CFSM)  model.  This  modeled  each  machine  in  the 
network  as  a  finite  automaton,  or  finite  state  machine,  with  communication  channels 
between  pairs  of  machines  modeled  as  one-way,  infinite  length  FIFO  queues.  There  has 
been  a  great  deal  of  work  in  this  area,  a  few  include  [PENG  91],  [VUON  83]  and  [RUDI 
83].  The  model  is  defined  for  an  arbitrary  number  of  machines;  however  for  simplicity  sake 
will  be  presented  as  a  two  machine  model  as  shown  in  Figure  1. 


Figure  1:  CFSM,  two  machine  behavior  representation 
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In  this  section  the  CFSM  model  will  be  defined  [GOUD  83]followed  by  a  simple 
protocol  analysis  to  illustrate  the  model. 

A  communicating  machine  Af  is  a  finite,  directed  labeled  graph  with  two  types  of 
edges,  sending  edges  and  receiving  edges.  A  sending  (receiving)  edge  is  labeled  ‘-g’  (‘+g’) 
for  some  message  g,  taken  from  a  finite  set  G  of  messages.  One  of  the  nodes  in  M  is 
identitied  as  the  initial  node,  and  each  node  is  reachable  from  the  initial  node  by  some 
directed  path.  A  node  in  M  whose  outgoing  edges  are  all  sending  (receiving)  edges  is  a 
sending  (receiving)  node;  otherwise  the  node  is  mixed  node.  If  the  outgoing  edges  of  each 
node  in  M  have  distinct  labels  then  M  is  determimstic,  otherwise  M  is  nondeterministic.  The 
nodes  of  Af  are  often  referred  to  as  states',  the  two  terms  are  used  interchangeably. 

Let  M  and  N  be  two  communicating  machines  having  the  same  set  G  of  messages;  the 
pair  (A/.A0  is  a  network.  A  global  state  of  this  network  is  a  four-tuple  where  m 

and  n  are  nodes  (states)  from  M  and  N,  and  c„  and  are  strings  from  the  set  G  of  messages. 
Intuitively,  the  global  state  [m.c„, 0^.11]  means  that  the  machines  M  and  N  have  reached 
states  m  and  n,  and  the  communication  channels  contain  the  strings  c^  and  c^  of  messages. 
Channel  c„  contains  the  messages  sent  from  M  and  N,  and  channel  c„  the  messages  sent 
from  N  to  M.  The  string  c,  will  be  referred  to  as  channel  c,. 

The  initial  global  state  of  (A/,A0  is  [m(,,E.E,nf,],  where  an  are  the  initial  states  of 
M  and  N,  and  E  is  the  empty  string. 

The  network  progresses  as  transitions  are  taken  in  either  M  or  N.  Each  transition 
consists  of  a  state  change  in  one  of  the  machines,  and  either  the  addition  of  a  message  to 
the  end  of  one  channel  (sending  transition)  or  the  deletion  of  a  message  from  the  front  of 
one  channel  (receiving  transition). 

A  sending  transition  in  M(N)  adds  a  message  to  the  end  of  channel  c„iCn);  a  receiving 
transition  in  M(N)  removes  a  message  from  the  front  of  channel  c„(c„). 

If  s i=[m,Ci,Cj,n]  is  a  global  state  of  (Af  jV),  and  state  S2  follows  si  if  there  is  a  transition 
(in  Af  or  AO  which  can  be  executed  in  sj,  such  that  the  resulting  state  is  S2.  A  state  S2  is 
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reachable  from  state  sj  if  there  is  a  sequence  of  states  such  that  si  follows  Sj, 

Si+i  follows  Si,  and  so  on,  and  S2  follows  5,+^.  A  state  s  is  reachable  if  it  is  reachable  from 
the  initial  state. 

The  communication  of  a  network  (M/i)  is  bounded  if,  for  every  reachable  state 
[m,c„,c„,n]  there  is  a  nonnegative  integer  k  such  that  |cj  s  k  and  |cj  s  *,  where  id  denotes 

the  number  of  messages  in  channel  c. 

/ 

A  reachability  graph  of  a  network  is  a  directed  graph  in  which  the  nodes 

correspond  to  the  reachable  global  states  of  (A/,A/),  and  the  edges  represent  the  follows 
function,  such  that  there  is  an  edge  from  state  Si  to  state  Sj,  if  and  only  if,  Sj  follows  j,.  The 
edges  are  labeled  with  the  transition  which  they  represent  The  reachability  graph  can  be 
generated  by  starting  with  the  initial  state,  and  adding  the  states  which  follow  it,  connecting 
them  to  it  with  edges;  and  repeating  for  each  new  state  generated.An  overview  of  the 
functional  units  of  the  CFSM  model  is  shown  in  Figure  1. 


Machine  1 


Figure  2:  CFSM  model  representation. 

A  global  state  [nt,c„,c„,n]  is  a  deadlock  state  if  both  m  and  n  are  receiving  nodes,  and 
c„=Cn=E,  where  E  denotes  the  empty  string. 

A  global  state  [m,c„,c„,n]  is  an  unspecified  reception  state  if  one  of  the  following  two 
conditions  are  true; 
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(1)  m  is  a  receiving  state,  the  message  at  the  head  of  channel  is  g,  and  none  of  MS 
outgoing  transitions  is  labeled  ‘-»-g.’ 

(2)  /I  is  a  receiving  state,  the  message  at  the  head  of  channel  c„  is  g,'and  none  of  n’s 
outgoing  transitions  is  labeled  ‘+g.‘ 

A  simplified  version  of  the  stop-and-wait  data  link  protocol  will  be  analyzed  as  an 
example  of  analysis  with  the  CFSM  model.  The  interfaces  between  layer  6  (user)and  layer 
2  (data  link)  of  the  Open  Systems  Interconnection  (OSI)  model  is  transparent  in  all  the 
examples  addressed  in  this  thesis.  An  assumption  is  made  that  the  higher  layer  has  passed 
the  information/frames  without  error.  The  frames  at  each  layer  have  accomplished  the 
appropriate  concatenation  of  header  and  address  information.  So,  at  layer  2,  this  protocol 
consists  of  two  distinct  entities,  a  sender  and  a  receiver.  Machine  one  serves  as  the  sender 
and  machine  2  serves  as  the  receiver  as  shown  in  Figure  3.  The  sender  places  a  frame  on 
the  channel  to  the  receiver.  The  receiver  senses  a  frame  on  the  incoming  channel  and 
accepts  the  message  from  the  channel,  removing  the  message  from  the  incoming  channel. 
The  receiver  then  sends  an  acknowledgment  packet  to  the  sender.  The  sender  senses  the 
acknowledgment  packet  and  is  clear  to  send  another  frame  of  information  to  the  receiver. 

I 

Machine  2 

+D 


Machine  1 


Figure  3:  CFSM  specification  for  stop-and-wait. 

The  finite  state  machines  in  Figure  3  represent  the  behavior  of  the  definition  of  the 
stop-and-wait  protocol.  The  -D  represents  sending  data,  +D,  receiving  data,  -A,  send 
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acknowledgment,  and  +/4,  receive  acknowledge.  As  per  the  definition  of  the  CFSM  model, 
there  is  two  channels,  one  from  machine  1  to  machine  2  and  one  hrom  machine  2  to  machine 
1.  The  notch  on  state  1  of  both  machines  represents  the  initial/starting  state. 

The  global  reachability  analysis  graph  shown  in  Figtire  4  is  free  from  deadlock, 
unspecified  receptions,  and  unexecuted  transitions. 

(— ►  [0,E,E,0] 

[1,D  E,0] 

.0 

[l.E  E,l] 

I* 

[1.E,A,0] 

I  +A 


Figure  4;  CFSM,  global  reachability  analysis,  stop-and-wait. 

This  model  has  many  desirable  features  as  well  as  some  disadvantages  that  are 
improved  in  the  SCM  model.  The  one  glaring  disadvantage  is  that  the  analysis  might  not 
terminate  if  the  queue  length  is  unbounded.  The  number  of  global  states  in  Figure  4  is 
trivial,  but  for  complex  specifications  the  number  of  states  will  lead  to  a  combinatorial  state 
explosion.  This  is  even  true  when  the  queue  length  is  very  restrictive.  As  pointed  out  in 
[LUND  91b),  the  specification  of  a  practical  protocol  can  be  so  complex,  containing 
hundreds  of  states  and  transitions,  that  the  user  can  not  be  sure  of  the  intended  specification 
or  grasp  the  intuitive  feel  for  what  the  protocol  is  intended  to  do.  This  model  has  the 
advantage  of  simplicity  and  a  method  of  analysis  that  can  be  easily  automated. 
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C.  SYSTEM  OF  COMMUNICATING  MACHINES 


In  this  section  the  model  used  to  specify  and  analyze  protocols  is  briefly  described.  A 
more  detailed  description  appears  in  [LUND  91a] .  Following  the  definition  of  the  model 
will  be  an  analysis  of  a  simple  protocol  to  illustrate  the  model. 

A  system  of  communicating  machines  is  an  ordered  pair  C  =  (My),  where 

Af={m/,m2,...^„) 

is  a  finite  set  of  machines,  and 

V=(V;,V2....V„} 

is  a  finite  set  of  shared  variables,  with  two  designated  subsets  and  specified  for  each 
Machine  m,-.  The  subset  /?,  of  V  is  called  the  set  of  read  access  variables  for  Machine  m,, 
and  the  subset  Wi  the  set  of  write  access  variables  for  m,. 

Each  Machine  m,  £  Mis  defined  by  a  tuple  (Si,SQjLiJ^i,Xi),  where 

(1)  5,-  is  a  finite  set  of  states; 

(2)  sq  £  5,  is  a  designated  state  called  the  initial  state  of  m,-; 

(3)  L,  is  a  finite  set  of  local  variables; 

(4)  N,  is  a  finite  set  of  names,  each  of  which  is  associated  with  a  unique  pair  ip, a), 
where  p  is  a  predicate  on  the  variables  of  Li  vj  Ri  and  a  is  an  action  on  the  variables  of 

Li  vj  Ri  vj  Wi 

(5)  T,;  Si  X  Ni  -*  Si  is  a  transition  function,  which  is  a  partial  function  fiom  the  states 
and  names  of  m,  to  the  states  of  m,. 

Machines  model  the  entities,  which  in  a  protocol  system  are  processes  and  channels. 
The  shared  variables  are  the  means  of  communication  between  the  machines.  Intuitively, 
/?,  and  Wj  are  the  subsets  of  V  to  which  m,  has  read  and  write  access,  respectively.  A 
machine  is  allowed  to  make  a  transition  from  one  state  to  another  when  the  predicate 
associated  with  the  name  for  that  transition  is  true.  Upon  taking  the  transition,  the  action 
associated  with  that  name  is  executed. 
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The  set  L,  of  local  variables  specifies  a  name  and  a  range  for  each.  The  range  must  be 
a  finite  or  countable  set  of  values. 

A  system  state  tuple  is  a  tuple  of  all  machine  states.  That  is,  if  {M,V)  is  a  system  of  n 
communicating  machines,  and  5,,  for  l  ^  ^  n,  is  the  state  of  Machine  mi,  then  the  n-tuple 
isi,S2f...j^  is  the  system  state  tuple  of  (A/,V). 

A  system  state  is  a  system  state  tuple  together  with  its  enabled  outgoing  transitions. 
Two  system  states  are  equivalent  if  every  machine  is  in  the  same  state,  and  the  same 
outgoing  transitions  are  enabled. 

The  initial  system  state  is  the  system  state  such  that  every  machine  is  in  its  initial  state, 
and  the  enabled  outgoing  transitions  are  the  same  as  in  the  initial  global  state. 

The  global  state  of  a  system  consists  of  the  system  state,  plus  the  values  of  all 
variables,  both  local  and  shared.  The  initial  global  state  is  the  initial  system  state,  with  the 
additional  requirement  that  all  variables  have  their  initial  values.  A  global  state 
corresponds  to  a  system  state  if  every  machine  is  in  the  same  state  and  the  same  outgoing 
transitions  are  enabled. 

Let  T(j/,n)  =  S2  ^  *  transition  which  is  defined  on  Machine  m,.  Transition  X  is 
enabled  if  the  enabling  predicate  p,  associated  with  name  n,  is  true.  Transition  X  may  be 
executed  whenever  m,  is  in  state  sj  and  the  predicate  p  is  true  (enabled).  The  execution  of 

X  is  an  atomic  action,  in  which  both  the  state  change  and  the  action  a  associated  with  n 
occur  simultaneously.  The  format  for  the  associated  predicate-action  table  is  shown  in 
Table  1. 
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GLOBAL.VARIABLE 


Figure  5:  SCM,  two  machine  behavior  representation. 
TABLE  1;  SCM,  two  machine  predicate-action  table  format. 


Transition 

Enabling  Predicate 

Action 

Transitions 
for  Machine  I 

Values  of  variables  that  must 
hold  true  for  the  transition  to  be 
enabled. 

The  heal  and  GLOBAL  variable 
behavior  when  the  transition  is 
taken. 

Transitions 
for  Machine  2 

Same  as  above. 

Same  as  above. 

Note  that  if  the  values  of  all  variables  are  restricted  to  some  finite  range,  then  the 
model  can  be  reduced  to  a  simple  finite  state  machine.  Otherwise  an  infinite  number  of 
global  states  are  possible.  However,  even  if  the  number  of  global  states  is  infinite,  the 
number  of  system  states  is  finite,  because  of  the  finiteness  of  each  machine.  This  may  allow 
a  reachability  analysis  on  the  system  states,  when  a  reachability  analysis  on  the  global  states 
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is  infinite.  General  behavior  of  the  SCM  model  is  shown  in  Figure  1  and  the  general  SCM 
model  representation  is  found  in  Figure  1. 


Figure  6:  SCM,  general  model  representation 

The  stop-and~wait  protocol  will  also  be  used  to  demonstrate  the  analysis  using  the 
SCM  model.  The  stop-and-wait  protocol  specification  is  the  same  as  defined  in  the  previous 
section.  The  specification  as  represented  by  the  SCM  model  is  shown  as  a  set  of  finite  state 
machines  and  a  predicate-action  table. 

The  finite  state  machine  representation  for  the  SCM  model  is  similar  to  the  CFSM 
example.  Again  this  protocol  is  only  demonstrated  with  two  machines.  The  FSM’s  are 
shown  in  Figure  3.  Also  shown  are  the  local  and  global  variables.  The  local  variables  in 
Machine  1  and  2  can  have  the  values  of  D(data),  A  (acknowledgment),  and  E(empty).  The 
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initial  value  for  out Jbuff  is  D  and  the  initial  values  for  all  other  variables  is  E.  The  system 
global  variable,  CHAN  can  have  the  same  values  as  the  local  variables. 

Machine  1  Machine  2 


Figure  7:  SCM  specification  for  stop-and-wait,  finite  state  machines  and  variable 

definitions. 

The  predicate-action  table  is  shown  in  Table  2.  For  this  example  the  assumption  is 
made  that  data  is  always  made  available  to  the  CHAN  from  outjyuff. 

TABLE  2:  SCM  specification  for  stopjtndjvait,  predicate  action  table. 


Transition 

Enabling  Predicate 

Action 

-D 

CHAN  =  £  A 
out_bi4f>=  E 

CHAN  ;=  outjft^ 

+A.  • 

RET^A 

RET .  =  £ 

CHAN  ;=  £ 

+D 

CHAN  /=  £ 

in_bi^:-  CHAN 

1 

> 

true 

RET  :=  A 
in_buff  :-  e; 
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The  global  state  reachability  and  system  state  reachability  graphs  are  found  in  Figure 
4  and  Figure  4.  The  format  for  the  global  state  tuple  of  the  stop-and-wait  protocol  is: 

[  Machine  l_state,  out_buff,  CHAN,  RET,  in_buff,  Machine2_state  ] 


-►[0,d,E,E,e,0] 

h” 

[  1  ,d,D,E,e,u] 

j.. 

[l,d,D,E,d,l] 

[l,d,D,A,d,0] 

l+A 


Figure  8:  SCM,  global  reachability  analysis,  stop-and-wait. 

The  format  for  a  system  state  tuple  for  all  cases  of  analysis  is: 

[  Machine  l_state,  Machine2_state  ] 

0] 

-D 

0] 

+D 

11 

-A 

0] 

+A 


Figure  9:  SCM,  system  reachability  analysis,  stop-and-wait. 
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The  SCM  model  has  desirable  properties  found  in  the  CFSM  model  as  well  as 
overcoming  some  of  the  inherent  disadvantages  of  the  CFSM  model.  In  the  SCM  model  the 
behavior  of  the  protocol  can  be  clearly  and  quite  adequately  represented,  maintaining  an 
intuitive  feel  of  the  specification.  The  SCM  model  can  ameliorate  the  combinatorial  state 
explosion  through  the  use  of  system  state  analysis,  greatly  reducing  the  generated  states. 
Instead  of  implicit  queues,  shared  variables  are  used  for  communications  between 
processes.  This  allows  communications  between  machines  in  non  sequential  manner, 
unlike  a  FIFO  queue  representation  in  the  CFSM  model. 

The  final  advantage  is  the  nature  of  the  SCM’s  representation  of  a  protocol  gives  it 
the  feel  of  a  programming  language.  Although  more  complex  to  program  than  a  CFSM 
model,  the  actions  associated  with  *Jie  FSM  and  the  predicate-action  table  lend  themselves 
to  automated  implementation. 

D.  LANGUAGE  CONSIDERATIONS 

Which  language  should  the  CFSM  and  SCM  models  would  be  implemented  in? 
Before  all  the  available  languages  were  researched,  a  list  of  desirable  properties  that  the 
language  must  have  (specific  to  the  models),  was  developed.  After  a  close  inspection  of  the 
definition  and  nuances  of  the  CFSM  model,  SCM  model,  and  the  reachability  analysis 
generated,  there  were  a  number  of  language  properties  that  were  found  desirable  to  this 
project. 

The  language  properties  should  support  hardware  and  software  design  issues.  The 
code  must  be  portable  from  one  architecture  to  another.  The  language  should  have  a  means 
to  create  different  class  instances  from  a  base  class.  An  intuitive  means  to  provide 
meaningful  output  of  the  analysis  and  progi’amming  error  messages  to  the  user  enhances 
the  program’s  utility.  Since  the  program  must  simulate  network  specifications  there  is  an 
inherent  need  to  be  able  to  do  multiprocessing  or  multitasking  in  the  programming 
environment.  The  language  of  choice  should  enforce  the  rules  of  strong  typing,  that  is  not 
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allowing  mixing  of  types  and  subtypes.  The  final  property  of  the  language  should  be  its  ease 
of  use  and  understandibility. 

The  language  of  choice  should  be  portable  between  different  machines.  It  cannot  be 
assumed  that  the  user  has  access  to  a  mainframe  computer  or  workstation.  The  language 
should  be  compilable  on  a  machine  as  small  as  a  personal  computer. 

Implementation  of  the  models  should  help  the  user  to  avoid  and  detect  mistakes.  The 
environment  should  prompt  the  user  when  a  syntactical  or  semantic  error  is  made.  The  error 
messages  should  be  meaningful.  Inherent  to  this  requirement,  the  language  should  enforce 
strict  definitions  of  atomic  structures,  such  as  data  structures. 

Dynamic  list  creation  /deletion  are  necessary  in  reachability  graph  construction.  This 
allows  flexible  and  ultimately  limitless  (hardware  specific)  analyses  to  be  done.  Linked  list 
creation  and  traversal  should  make  use  of  reusable  programming  units.  The  logic  for 
creating  new  nodes  should  allow  the  program  to  ‘remember’  where  the  last  node  was  built. 
This^should  be  done  automatically,  without  user  intervention  after  compile  time. 

An  important  property,  although  subject  to  vaiying  opinion,  is  ease  of  use.  The  project 
is  developed  in  one  language,  but  the  human  interface  to  the  underlying  code  must  be 
understandable  and  intuitive.  Hand  in  hand  with  ease  of  use,  is  ease  of  maintainability. 
There  should  be  enough  on-line  and  off-line  help  to  allow  the  user  to  navigate  the  the  user 
interface.  An  understandable  debugger  was  also  a  factor  in  the  choice. 

Ada  was  chosen  because  it  supports  the  above  mentioned  properties.  It  is  a  language 
that  is  portable  between  different  architectures.  It  supports  generic  class  creation  and 
instantiation.  Through  the  use  of  predetined  input  and  output  packages,  the  user  is  allowed 
to  build  a  suitable  interface  environment.  With  the  use  of  exception  handling  meaningful 
error  messages  can  be  created  and  employed.  Ada  also  has  the  ability  to  multitask, 
simulating  parallel  processing.  Finally,  Ada  is  easy  to  use.  The  code  can  be  read  by  a  novice 
and  understand  what  is  meant  to  happen. 

The  language  of  CyC++  was  not  chosen  due  to  a  few  limitations.  At  the  time  of  this 
writing  it  could  not  support  multitasking  needed  to  simulate  concurrency  or  broadcast 
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networks.  It  was  also  difficult  to  do  generic-like  coding.  The  object  orientation  of  the 
design  lent  itself  very  nicely  to  the  structures  used  in  the  CFSM  and  SCM  model  as  covered 
in  [RUMB  91].  It  became  apparent  that  there  was  reused  code  that  would  have  been  more 
efficiendy  implemented  with  generic  data  structures.  Although  it  could  have  been  done 
with  the  use  of  macro-like  instructions,  generic  packages  made  the  project  more  compact 
and  efficient  Generic  package  creation  and  instantiation  was  not  supported  by  the  current 
version  of  the  C/C++  compiler.  The  C  programming  environment  does  not  support 
exception  handling;  programming  error  detection  messages  were  vague  and  could  not  be 
developed  by  the  user.  A  good  means  of  automatic  implementation  of  error  messages  in  the 
C++  environment  was  not  available  at  the  time  of  this  publishing.  Ada  could  do  this 
through  use  of  exception  handling. 
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in.  A  PROGRAM  FOR  GENERATING  A  CFSM  REACHABILITY 

ANALYSIS 


In  this  chapter  the  organization  of  the  CFSM  program  will  be  describedThe  mean^  for 
input,  output,  and  reachability  analysis  will  be  highlighted.  Excerpts  of  the  underlying  code 
will  be  accompanied  by  a  brief  explanation.  The  formal  definition  of  the  CFSM  model 
found  in  Chapter  11  is  the  basis  for  constructing  the  program. 

A.  PROGRAM  STRUCTURE 

The  structure  of  the  CFSM  program  is  based  on  functional  units  (objects)  of  the 
general  CFSM  model.  The  data  structures  of  the  basic  objects  must  represent 
communication  channels,  machine  states,  transitions,  and  a  means  for  capturing  global 
tuple  (state)  values.  In  addition  to  constructing  the  fundai  ntal  data  structures,  there  must 
be  an  intuitive  input  mechanism  for  the  FSM’s  and  an  understandable  display  of  the 
analysis. 

Implementation  details  should  be  hidden  from  the  user.  Operations  such  as  loading  the 
CFSM  into  memory,  performing  a  reachability  analysis,  constructing  the  global 
reachability  graph,  and  traversing  the  graph  during  searches/output  are  independent  of  the 
specific  protocol  to  be  analyzed. 

The  program  consists  of  input  related  procedures,  a  reachability  analysis,  and  output 
procedures.  To  help  manage  such  a  complex  and  large  programming  project,  separate 
compilation  units  were  used.  The  compilation  units  were  physically  grouped  by  file 
according  to  the  function  it  performed  as  shown  below: 

TABLE  3:  CFSM  compilation  units. 


Compilation  Unit 

Description 

File 

read_in_filc 

parse  text  input  file 

input.a 

load_machine_aiTay 

builds  machine  adjacency 
lists  from  parsed  file 

input.a 
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Compilation  Unit 

Description 

FUe 

build_Gstate_graph 

builds  global  reachability 
analysis  graph 

reachability.a 

clear_pointers 

clears  values  for  another 
input  file 

reachability.a 

search_for_tuple 

performs  BFS  search  of 
graph 

search.a 

IsEqual 

compares  global  records 
for  equality  (similar  to  =) 

search.a 

output_Gstate_node 

format  for  node  output 

output.a 

output_Gstate_transition 

format  for  transition  output 

output  a 

output_Gstates 

traverses  graph  and  outputs 
nodes  and  transitions 

outputa 

output_machine_arrays 

format  output  of  contents 
of  adjacency  lists 

output  a 

create_output_file 

creates  file  for  analysis  out¬ 
put 

outputa 

This  use  of  separate  subprograms(compilation  units)  facilitated  the  development  of  the 


SCM  program  from  existing  CFSM  code. 

The  behavior  at  run  time  is  shown  in  Figure  10  and  associated  files  of  the  CFSM 
program  are  shown  in  Figure  1 1 . 


Reachability 

Text  File  (FSM’s)  Analysis 


Figure  10:  CFSM  run  time  behavior 
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main  procedure 


Generic  Packages  I  Stacks 


During  the  design  phase  of  the  program  it  became  apparent  that  some  software 
components  and  structures  were  used  more  than  once.  For  instance,  when  doing  a 
reachability  analysis  many  types  of  stacks  and  queues  were  used.  Although  the  underlying 
data  types  were  different,  the  algorithm  for  each  structure  was  exactly  the  same.  To  increase 
efficiency,  generic  packages  were  used.  Generic  units  are  defined  as  a  reusable  software 
module  or  a  program  unit  template  [GONZ  91]. 

The  implementation  of  stacks  and  queues  is  accomplished  using  generics.  For 
instance,  within  the  program  there  is  a  need  for  a  queue  of  characters  representing  the  flow 
of  information  on  the  channels  between  two  machines.  To  assist  in  the  construction  of  the 
reachability  graph  there  needs  to  be  a  queue  of  pointers  to  graph  nodes  (see  Section  C). 
Each  type  of  queue  has  some  common  procedures  and  functions.  Each  needs  procedures  to 
clear  the  queue,  enqueue,  and  dequeue.  Each  must  also  have  functions  that  return  the  value 
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of  the  first  item  of  the  queue,  determine  if  the  queue  is  empty  and  determine  if  the  contents 
of  two  queues  are  equal.  If  these  common  functions  and  procedures  had  to  be  rewritten  with 
a  different  underlying  data  type,  the  number  of  compilation  units  as  well  as  the  object  code 
would  increase;  thus  the  user  would  be  saddled  with  more  ‘waiting’  time. 

The  protocol  environment  can  be  modified  by  using  generic  parameters.  The  generic 
package,  queues,  has  two  parameters  to  the  object-  the  item  type  and  the  maximum  size  of 
the  queue.  This  allows  the  user  to  define  what  type  of  items  are  contained  in  the 
channel(queue)  and  how  big  the  channel(queue)  can  be.  Two  instantiations  of  queues  in  the 
program  are: 

package  queue_pack  is  new  queues (character,  MAX*>3) ; 

package  Gpointer_queue_pack  is  new  cjueues (Glink_type,MAX»>10) ; 

The  queue  jack  package  deHnes  a  queue  of  characters.  A  ceiling  or  bound  can  be  placed 
on  the  amount  of  messages  on  a  channel.  If  an  unbounded  channel  is  to  be  simulated  the 
maximum  allowable  integer  can  be  given.  The  pointer  queue  Gpointer_queue  jack  gives 
the  user  a  means  to  determine  the  maximum  size  of  a  reachability  graph.  Although,  in  the 
general  case,  a  large  number  is  preferred  to  allow  all  tuples  (states)  to  be  generated  in  a 
protocol  reachability  graph.  The  generic  package  stacks  was  implemented  in  a  similar 
fashion. 

B.  INPUT 

An  important  step  in  designing  the  CFSM  and  SCM  programs  is  developing  a 
meaningful  method  of  inputting  the  finite  state  machines.  The  graphical  representation  of 
a  simple  FSM  conveys  a  behavior  associated  with  a  protocol  specification.  A  means  to 
transfer  this  graph  into  a  data  structure  that  can  be  used  in  the  reachability  analysis  was 
developed. 

The  FSM’s  were  input  as  a  text  file.  This  file  is  built  by  the  user  with  a  set  of  language 
rules  similar  to  Backus-Naur  Form  (BNF).  The  input  file  is  parsed  one  line  at  a  time.  Each 
line  is  read  into  a  line  buffer  and  tokens  formed  according  to  the  rules  defined  below.  From 
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the  tokens,  an  internal  data  structure  is  generated  to  represent  the  set  of  finite  state 
machines.  The  list  of  valid  instructions  for  finite  state  machine  input  is: 


start 

machine  <natural> 

state  <natural> 

initial  state  <natural>  <natural> 

trans  <- 1 +>  <a I b I . . . 1 2  I A I B | . . . | Z>  <natural> 

finish 

The  tokens  are  cast  into  either  enumerated  types  (instructions)  or  integers  (integer 
variables).  The  integer  variables  have  been  formally  defined  within  the  main  procedure  in 
Appendix  A. 

The  meaning  of  the  instructions  are: 


start  Serves  as  a  beginning  flag  for  the  file, 

machine  Defines  the  current  machine, 

state  Defines  the  current  state. 

initial_state  The  intitial/start  state  for 

machines  one  and  two. 

trans  Transition  type,  transition 

message,  and  next  state. 

finish  This  token  serves  as  an  ending  flag  for 

the  file. 

Representation  of  a  finite  state  machine  using  the  above  convention  has  some  inherent 
constraints.  Since  an  input  token,  such  as  the  transition  -D,  cannot  be  directly  caste  into  an 
enumeration  token  (no  special  characters  at  the  beginning  of  a  token),  the  (-,+)  must  be 
converted  separately  to  (sndjev)  tokens.  The  use  of  alphabetic  characters  to  represent 
messages  in  a  channel,  limits  messages  to  52  distinct  types  (a..z,A..Z).  The  input  file  for 
stop_and_wait  is: 


start 
machine  1 
state  0 
trans  -D  1 
state  1 
trans  +A  0 
machine  2 
state  0 
trans  +D  1 
state  1 
trans  -A  0 
initial_state  0  0 
finish  ~ 
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The  data  structure  representing  the  CFSM  is  then  used  to  construct  a  reachability 
analysis  graph.  The  two  data  structures  that  support  directed  graphs  (or  finite  state 
machines)  are  adjacency  lists  and  adjacency  matrices.  Since  the  use  of  adjacency  matrices 
to  construct  directed  graphs  can  lead  to  wasted  hardware  memory,  adjacency  lists  (one 
dimensional  array  of  linked  lists)  were  implemented. 

The  data  structure  to  build  the  adjacency  list  and  the  constraints  are: 


type  machine_array_recordl_type; 

type  Mlin)c_type  ia  access  machine_array_record_type; 
type  c£sm_transition_type  is  (snd,  rev, unused) ; 
type  executed_type  is  (yes, no); 
type  machine_array_record_type  is 
record 


transition 

message 

next_state 

executed 

Mlink 

end  record; 


:  cf sm_transition_type; 
:  character; 

:  natural; 

:  executed_type; 

:  Mlink_type 


type  machine__array_type  is  array  (positive  rangeO) 
of  Mlin)c_type; 

type  system_array_type  is  array(1..2) 
of  machine_array_eype; 


Some  data  structures  shown  above  are  peculiar  to  Ada.  Access  types  are  data  types  that 
provide  an  access  (“pointer”)  to  an  object  of  another  type  or  subtype.  It  resei-ves  storage 
locations  during  the  execution  of  a  program  dynamically  by  use  of  a  memory  allocator.  A 
record  type  is  simply  a  collection  of  elements  where  each  element  is  referred  to  by  its  name. 
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The  anay  of  linked  lists  is  defined  as  an  unconstrained  array;  whereas,  at  compile  time,  the 
number  of  machines  is  set  at  two.  To  illustrate  the  finite  state  machine  data  structure  the 
CFSM  stopjind  wait  protocol  is  shown  in  Rgure  12. 

Machine  1 


w 

C/5 


Machine  2 


w 

cd 

C/3 


Rgure  12:  Finite  State  Machine  representation,  stop  and  wait 
C.  REACHABILITY  ANALYSIS 

In  order  to  determine  if  all  states  in  a  network  arc  reachable  a  graph  is  constructeds 
After  the  textual  representation  of  the  CFSM  is  input,  the  adjacency  lists  are  constructed  as 
described  in  the  previous  section.  The  initial  states  for  each  machine  indicate  the  starting 
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position  of  each  list.  From  the  lists  a  directed  graph  is  constructed.  It  is  from  this  directed 
graph  that  deadlocks  and  unspecified  receptions  are  sensed  and  the  appropriate  output 
message  is  displayed. 

The  algorithm  to  construct  the  global  reachability  graph  is: 


loop 

formachitul  array  index  in  l..rowsize  loop 

if  machinel  {array  Jndex).transition^snd  or 
machinel(array_index)jrussage~top_qf.queue21  then 
make  temp  Gstate  record 
search  list  for  Gstate  record 

f  found  then  link  current  to  found  state 
else  make  new  node  and  link  into  Gstate  jgraph 
and  push  ptmter  onto  pointer  stack 
else  none  Jound 
end  loop 

for  machine2  array Jndex  in  l..rowsize  loop 

if  machine2  ( array _index).transition=snd  or 
machine2(array_index)jnessage=top_of.queuel2  then 
make  temp  Gstate  record 
search  list  for  Gstate  record 

f found  then  link  current  to  found  state 
else  make  new  node  and  link  into  Gstate _graph 
and  push  pointer  onto  pointer  stack 
else  none  Jound 
end  loop 

if  stack  is  empty  then 

raise  STACK  EMPTY 
else 

pop  last  Gstate 

end  loop 


The  initial  global  state  tuple  (node)  is  created  from  the  starting  state  of  each  machine’s 
adjacency  list  From  the  top  node,  tuples  (global  states)  are  added  to  the  graph  using  the 
reachability  algorithm.  The  algorithm  shows  the  graph  being  constructed  with  stack  based 
implementation,  allowing  a  breadth  first  construct.  The  option  is  given  to  the  user  ro 
construct  the  graph  depth  first.  A  case  statement  is  used  to  toggle  between  stack  or  queue 
procedures/functions  (this  is  not  shown  in  the  algorithm  above.)  Figure  13  shows  the 
internal  representation  of  the  global  reachability  graph  for  the  stop  and  wait  protocol 
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Figure  13:  CFSM  internal  reachability  graph,  stop  and  wait 


Note  that  when  a  tuple  is  generated  a  data  structure  representing  a  transition  and  a  node  are 
separately  added.  The  field  new  node  was  included  in  the  transition  structure  to  allow 
prope*  traversal  of  the  graph.  The  current  version  of  the  program  allows  for  four  transitions 
from  each  tuple.  This  can  be  expanded  upward  if  needed. 

Exception  handlers  were  used  to  maintain  control  in  the  reachability  graph 
construction.  Whenever  a  queue  or  stack  is  empty  the  control  is  handed  to  the  exception 
handler  to  continue  program  execution.  The  exception  handlers  allow  definition  of  specific 
error  conditions  to  be  sensed  and  appropriate  action  taken. 

During  graph  construction,  global  state  tuples  are  identified  that  satisfy  the  deadlock 
and  unspecified  reception  properties.  If  a  global  state  node  has  only  receiving  transitions 
from  it  and  both  the  queues  are  empty,  a  deadlock  message  is  displayed  to  output.  If  the 
global  state  node  has  outgoing  receive  transitions  and  the  head  of  the  respective  queue  does 
not  match  the  receive  transition  (assuming  the  queue(s)  are  not  empty)  then  an  unspecified 
reception  message  is  displayed  to  output.  When  the  construction  of  the  graph  is  complete 
the  adjacency  lists  arc  checked  for  any  unexecuted  transitions.  The  contents  of  the  lists  are 
displayed  after  the  output  of  the  graph  is  done.  Unexecuted  transitions  arc  identified  by  the 
execution  field,  with  a  no  entry.  For  an  example  see  Figure  15 

Upon  completion  of  the  reachability  graph  construction,  a  pointer  to  the  top  global 
state  node  is  passed  to  the  output  procedure. 

When  constructing  a  reachability  graph  there  are  two  factors  that  need  to  be 
considered-  run  time  and  the  size  of  the  graph  generated.  As  noted  earlier,  a  ceiling  can  be 
placed  on  the  size  of  the  graph  by  the  user  prior  to  compilation.  Ideally,  a  specification  can 
be  input  to  the  program  and  an  analysis  could  run  for  as  long  as  needed  (perhaps  days); 
however,  most  computer  systems  are  limited  by  storage.  The  question  of  storage  capacity 
is  left  to  the  user  of  the  program.  A  determination  must  be  made  as  to  how  large  a  graph  to 
anticipate  (worst  case  is  the  largest  integer  represented  on  the  register)  and  how  much 
storage  space  can  the  underlying  system  provide. 
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The  design  of  the  program  addresses  the  issue  of  running  time.  The  running  time,  or 
complexity,  of  the  reachability  analysis  is  dominated  by  the  algorithm  that  governs  the 
directed  graph  traversal.  All  traversals  are  done  in  both  models  (CFSM  and  SCM)  in  a 
recursive,  depth  first  manner.  The  complexity,  or  big  O  notation,  for  traversals  of  a  directed 
graph  can  easily  be  defined.  Consider  a  reachability  graph  G-iVyE)  consisting  of  a  set  V  of 
vertices(nodes),  and  a  set  E  of  edges(transitions).  Each  edge  correspond.'  to  a  pair  of 
distinct  vertices  in  the  directed  graph.  Tuc  running  time  or  complexity  of  such  a  graph 
traversal  is  proven  by  induction  to  be  (9(IV1  +  l£l).  A  rigorous  proof  of  the  complexity 
appears  in  [MANB  89]. 

D.  OUTPUT 

The  output  procedure  for  the  CFSM  tool  displays  the  reachability  graph  and 
associated  messages  to  both  a  text  file  and  the  default  output  device.  'P'e  output  procedure 
has  as  a  parameter  a  pointer  to  the  top  global  state  (node).  From  the  top  node  the  graph  is 
traversed  in  a  depth  first  manner  and  saved  to  an  output  medium.  The  contents  of  the 
adjacency  list  arc  also  displayed  to  output  providing  a  means  to  cross  check  the  CFSM 
construction  and  identify  unexecuted  transitions  as  shown  ioxsiopj2nd_wait  in  Figure  14. 
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REPOMfilLITY  ANALYSIS  of  :  stop_and.Mit 

1 

C 

0  ,  E  .  E  ,  0  1 

-D 

[  1  ,  D  ,  E  ,  0  ] 

2 

C 

1  ,  D  .  E  .  0  ] 

♦D 

C  1  ,  E  .  E  ,  1  ] 

3 

[ 

1  ,  E  .  E  .  1  ] 

-A 

t  1  ,  E  ,  A  ,  0  ] 

4 

C 

1  .  E  ,  A  ,  0  I 

♦A 

t  0  .  E  ,  E  ,  0  ] 

1  Hachine  1  Array  Contents  1 

1  FroM 

1  To  1 

Transition  1 

Executed  1 

1  0 

1  1  1 

snd  0  1 

yes  1 

1  1 

1  0  1 

row  A  1 

yes  1 

1  Hachine  2  Array  Contents  1 

1  FroM 

1  To  1 

1  Transition  1 

Executed  1 

1  0 

1  1  1 

1  rev  D  1 

yes  1 

1  1 

1  0  1 

1  snd  A  1 

yes  1 

•  The  nodes  generated  by  the  analysis 
were  done  in  a  breadth  first  Manner 


Figure  14:  CFSM,  analysis  output,  stop_and_wait 

To  illustrate  the  formatting  of  the  model’s  output  an  example  is  presented.  Assume 
that  a  CFSM  exists  reflected  by  the  following  specification: 


Machine  1 


The  input  file  is: 


Machine  2 

+X 
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start 
machine  1 
state  1 
trans  -D  2 
state  2 
trans  ♦fl  1 
machine  2 
state  1 
trans  +0  2 
state  2 
trans  -A  1 
initial.state  1  1 
finish 


The  output  file  reflecting  deadlock,  unspecified  receptions,  and  unexeci  ted  transitions 
is  shown  in  Figure  15. 


REAOMIILITY  MMLYSIS  of  :  dMdlock.exanpla 


1 

2 

7 

3 

4 

5 

6 


C  1  .  E  . 

C  2  .  X  . 

C  2  ,  E  , 
C  1  ,  E  . 
C  2  ,  X  , 
C  2  ,  E  . 
C  2  ,  E  , 


E  ,  1  ] 

-X 

t  2  .  X  ,  E  ,  1  ] 

2 

-B 

t  1  ,  E  ,  B  .  3  ] 

3 

E  .  1  ] 

-B 

C  2  ,  X  ,  B  .  3  ] 

4 

♦X 

[  2  ,  E  ,  E  ,  2  ] 

7 

E  .  2  ] 

—  «« 

mwx  llEfin.0a<  Condition  nrwiniiiiiiii 

B  ,  3  ] 

-X 

[  2  ,  X  ,  B  ,  3  ] 

4 

B  ,  3  1 

♦X 

C  2  ,  E  .  B  .  1  ] 

5 

B  ,  1  ] 

-B 

t  2  ,  E  ,  BB  ,  3  ] 

6 

BB  ,  3  ] 

«* 

•»*ee  Unspecified  Reception  mmmm 

1  Hachine  1  Array  Contents  1 

1  Free 

1  To 

Transition  1 

Executed  1 

1  1 

1  2 

snd  X  1 

yes  1 

1  2 

1  1 

rev  A  1 

no  1 

1  Machine  2  Array  Contents  1 

i  From 

1  To 

Transition  1 

Executed  1 

1  1 

1  3 

snd  B  1 

yes  1 

1  1 

1  2 

rev  X  1 

yes  1 

1  2 

1  1 

rev  B  1 

no  1 

1  3 

1  1 

rev  X  1 

yes  1 

«  The  nodes  generated  by  the  analysis 
were  done  in  a  depth  first  namer 


Figure  15;  CFSM,  analysis  output,  deadlock/unspecified  reception/unexecuted  transition 

example. 
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rv.  AN  AUTOMATED  TOOL  FOR  SCM  REACHABILITY 

ANALYSIS 


In  this  chapter,  a  program  is  introduced  that  automates  the  SCM  piodel .  It  provides 
an  intuitive  environment  to  input  a  protocol  specification  and  receive  the  analysis  in  an 
understandable  format.  Since  the  model  only  uses  variables  and  finite  state  machines  to 
describe  a  protocol’s  behavior,  it  is  considered  an  approximate  model.  There  are  certain 
details  of  protocol  design,  such  as  message  and  header  format,  that  are  abstract  from  the 
analysis.  The  succincmess  of  a  protocol  representation  helps  analyze  the  logic  and  structure 
without  getting  lost  in  a  myriad  of  detail. 

The  organization  of  this  program  is  similar  to  that  of  the  CFSM  program.  A  means  for 
input,  output,  global  reachability  analysis,  and  system  reachability  analysis  are  highlighted. 
Excerpts  of  the  code  are  accompanied  by  a  brief  explanation  of  structure  and 
application.The  formal  definition  of  the  SCM  model  found  in  Chapter  II  is  the  basis  for 
constructing  the  program. 
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The  protocol  specification  and  analysis  of  the  stop  and jvait  data  link  protocol  will 
be  used  throughout  this  chapter  to  demonstrate  the  interface  of  the  program  to  the  user.  The 


specification  for  the  sample  protocol  is  shown  in  Figure  16. 

Machine  I  Machine  2 


Transition 

Enabling  Predicate 

Action 

xmtjdata 

CHAN  =  £  A 

CHAN  ;=  outJ)uff 

rcvjjck 

RET  =  A 

RET . =  £ 

CHAN .  -  £ 

rcvjkua 

CHAN  l=E 

injjuff:^  CHAN 

xmtjxck 

true 

RET  ;*  A 
injbuff  :=  e; 

Figure  16:  SCM,  specification  for  stop  and  wait. 

A.  PROGRAM  STRUCTURE 

The  structure  of  the  SCM  program  is  similar  to  the  CFSM  implementation.  There  must 
be  a  means  for  input,  output,  and  reachability  analysis.  The  input  is  more  complex  because 
not  only  must  the  FSM’s  must  be  entered,  but  also  variable  definitions  and  the  associated 
predicate-action  table  as  shown  in  Figure  16.  The  input  can  be  viewed  as  hierarchical.  The 
global  and  system  reachability  analysis  are  performed  using  different  algorithms  and  are 
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described  in  later  sections.  The  code  for  producing  output  is  identical  to  the  CFSM  program 
with  some  addition  to  allow  the  user  to  tailor  variable  output 

Text  File  (FSM’s) 


Figure  17:  SCM  run  time  behavior. 

The  program,  written  in  Ada,  consists  of  packages,  procedureSr^nd  functions  that 
make  up  the  basic  structure  mentioned  above.  A  package  specifies  a  group  of  logically 
related  entities,  such  as  types,  and  objects  of  those  types  as  defined  in  [GONZ  91]  and 
[SKAN  88].  The  procedures  and  function  that  were  subject  to  change/updates  were  also 
treated  as  separate  compilation  units.  To  give  a  ‘feel’  for  the  different  components  of  the 
program,  the  separate  compilation  units  and  the  files  that  contain  them  are  shown  in  Table 
4. 


TABLE  4:  SCM  compilation  units. 


Compilation  Unit 

Description 

File 

read_in_file 

parses  text  input  hie 

input.a 

load_machine_array 

builds  machine  adjacency 
lists  form  parsed  file 

input.a 

build_Gstate_graph 

builds  global  reachability 
analysis  graph 

globai_reachability.a 
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Compilation  Unit 


Description 


File 


clear_pointers 

clears  the  values  for 
another  input  file 

global_eachability.a 

search_for_Gtuple 

performs  BFS  search  of 
global  reachabililty  graph 

global_search.a 

IsEqual 

compares  global  records 
and  associated  transitions 
for  equality 

global_seaich.a 

build_S  state_graph 

builds  system  reachability 
analysis  graph 

system_reachability.a 

search_for_StupIe 

perfoms  BFS  search  of 
graph 

system_search.a 

IsSysStateEqual 

compares  system  records 
and  associated  transitions 
for  equality 

system_search.a 

output_Gstate_node 

format  for  node  output 

global_output.a 

output_Gstate_transition 

format  for  transition  output 

global_output.a 

output_Gstates 

traverses  graph  and  outputs 
nodes  and  transitions 

global_output.a 

output_machine_arTays 

format  output  of  contents 
of  adjacency  lists 

global_output.a 

output_S  state_nocle 

format  for  node  output 

system_output.a 

output_Sstate_transition 

format  for  transition  output 

system_output.a 

output_S  states 

traverses  graph  and  outputs 
nodes  and  transitions 

system_output.a 

output_Gtuple 

format  global  record  for 
output 

user_output.a 

variable_definitions 

user  defined  protocol  vari¬ 
ables 

user_definitions.a 

Analyze_Predicates 

performs  analysis  of  predi¬ 
cates  and  determines  which 
transitions  are  enabled 

predicate_ac  tion .  a 
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Compiladon  Unit 

Oescripdon 

File 

Acdon 

changes  the  global  and 
local  variables  based  on  the 
transidon  executed 

predicate.acdon.a 

The  user  has  access  to  the  last  three  files  shown  in  Table  4.  The  variable  definition  package. 
Predicate _Anatysis  function,  and  Action  procedure  contained  in  these  files  are  modified  by 
the  user  to  reflect  the  specific  protocol  to  be  analyzed.  Formats  for  each  unit  will  be 
oudined  in  Sections  B,  C,  and  D.  The  other  files  and  procedures  will  remain  hidden  from 
the  user  because  they  are  Independent  of  any  protocol  to  be  analyzed.  Figure  18  shows  the 
files  and  generic  units  used  at  compilation  dme. 


»nain  procedure 


input.a 


predicate  _action. a 


user_definitions.a 


Separate 

Compiladon 

Units 


globai_ 

outputa 


system_ 

outputa 


global^ 

searrh.a 


system_ 

search.a 


global_ 

reachability.a 


system. 

reachabillity.a 


Figure  18:  SCM  compilation  units. 
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B.  INPUT 


An  intuitive  and  understandable  means  to  input  a  specificadon  is  helpful  in  any 
protocol  analysis  program.  A  protocol  specificadon  is  divided  into  shared  and  local 
variable  deflnidons,  predicate-acdon  table  representadon,  and  finite  state  machine  storage 
structure. 

The  different  parts  to  each  specificadon  to  be  analyzed  must  be  input  in  a  certain  order. 
The  definition  package.  Analyze _Predicate  funcdon,  and  Action  procedure  must  be 
constructed  and  compiled  before  the  program  is  executed.  When  the  program  is  executed 
the  user  then  inputs  the  FSM  text  file  and  obtains  the  reachability  analysis.  Since  the 
compiladon  of  the  program  depends  on  the  variables  in  the  definition  package,  this  package 
is  written  and  compiled  first.  This  is  a  technique  to  verify  variable  definidon  correctness  in 
the  Ada  environment.  Once  the  definitions  package  is  compiled  the  Analyze  Predicate 
funcdon  and  Action  procedure  can  then  be  compiled  This  step-wise  refinement  facilitates 
error  free  specificadon  representadon. 

At  any  point  in  execudon  of  the  program  the  status  of  all  variables  is  kept  in  the  global 

t 

state  record.  Each  node  in  the  global  reachability  graph  has  a  copy  of  this  record.  Within 
the  main  procedure  a  global  state  record  is  declared  as 


type  G3tate_record_type  is 
record 

machine l_3tate  :  machinel_3tate_type; 
inachine2_3tate  :  raachine2_3tate_type; 
global_variable3  :  global_variable_type; 
end  record; 

Having  the  machine  and  global  types  defined  in  a  separate  package  ensures  that  only  select 
pieces  of  code  can  be  modified  by  the  user.  The  definitions  package  contains  the 
machine  1  jstatejype,  machine!  state  type,  and  global_variable_type  declaradons;  thus 
this  package  must  be  compiled  first. 

The  order  that  each  input  category  is  covered  in  this  chapter  reflects  order  that  the 
protocol  specification  should  be  constructed  and  compiled. 
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1.  Protocol  Variable  Deflnitions 


The  user  defines  the  protocol  environment  variables  in  the  defirUtions  package. 

Variables  can  either  be  local  to  a  specific  machine  or  global  to  the  system.  The  global 

variables  are  considered  shared  and  allow  communication  between  the  machines  in  the 

system.  The  local  variables  are  only  visible  to  the  machine  that  they  are  defined  for.  A 

discrete  variable  can  be  one  of  the  many  Ada  defined  types  such  as: 

integer  natural  character 

array  digit  boolean 

record  access 

These  types  variables,  or  their  subtypes,  can  be  used  to  define  protocol 
environment 

A  template  for  the  definitions  package  is  illustrated  in  Figure  19.  The  shaded 
areas  of  the  figure  are  where  the  variables  of  the  protocol  are  inserted.  All  other  code  should 
remain  unchanged.  Additional  type  declarations  should  be  placed  before  the  machine  type 
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declarations.  The  state  number  of  each  machine  is  initialized  to  one  even  though  this 

maybe  different  based  on  the  FSM  text  file  is  input  (the  initial  state  is  explicitly  given.) 

^  FSM  transitioa  labels 

package  definitions  is 
type  scm_transition_type  is  ( 


)  ; 


.{protocol  dependent  types 


type  machinel_state_type  is 
record 

state  number  :  natural 


end  record; 

type  machine2_state_type  is 
record 

state  number  :  natural 


1; 


lachine  1  local  variables 


end  record; 


type  global_variable_type  is 
record  — 


end  record; 
end  definitions; 


lachine  2  local  variables 


global  (shared)  variables 


Figure  19:  SCM,  definitions  package  template. 

The  variable  declarations  for  the  stop_and_wait  protocol  arershown  in  Figure 


20. 


package  definitions  is 

type  3cm_transition_type  is 


type  buf£er_typa  is  (d,«,a); 

type  machinel_3tate_type  is 
record 

3tate_number 

out_bu££ 

end  record; 

type  machine2_3tate_type  is 
record 

3tate_number 

in_bu££ 

end  record; 


( snd_data ,  ccv_data , 
and  ack,  rev  ack) ; 


:  natural  :=•  1; 

:  buf£er_typ«  :=  d; 


:  natural  :=•  1; 

:  bu££ar_type  :=  •; 
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type  global_variable_type  is 
record 

CHAN  :  bu£fer_typ«  K; 

ACT  :  bu£fer_typ«  :«  ■; 

end  record; 
end  definitions; 

Rgure  20:  SCM,  definitions  package,  stop_and_wait. 

The  transitions  are  represented  as  xmt_data,  xmt  ack,  rcv_data,  and  rcvjjck 
instead  of  -D,  -/4,  +D,  and  +A.  Machine  one  has  a  local  variable  that  serves  as  an  out-bound 
buffer  ifiutjyuff).  It  is  initialized  with  data  present  in  the  buffer,  represented  by  'd\  The 
only  machine  that  sees  the  variable  contents  is  Machine  one.  Machine  two  is  similar  in  that 
it  has  a  buffer  for  receiving  {injjuff)  data  from  the  channel.  The  global  variables  are  the 
shared  variables  channel  (CHAN)  and  a  return  link  (RET).  Both  variables  are  initialized 
empty  and  can  be  accessed  by  each  machine.  The  values  that  CHAN,  RET,  in  buff,  and 
outjbiff  can  have  are  defined  as  a  buffer jype.  The  buffer  type  variables  can  have  the 
values^  (empty),  d  (data),  or  a  (acknowledgement).  The  stop_and_wait  protocol  example 
shows  how  easily  variables  can  be  represented.  All  the  text  in  bold  lettering  are  user  defined 
variables  and  types. 

2.  Predicate-Action  Table  Representation 

The  predicate-action  table  serves  as  the  engine  to  the  analysis.  The  enabling 
predicate  defines  the  logic  that  must  hold  true  for  the  transition  to  be  taken  (refer  to  Table 
1).  Local  and  global  variables  must  meet  these  conditions.  A  number  of  transitions  could 
be  enabled,  but,  for  a  transition  to  be  executed  the  state  of  the  machine  must  be  considered. 
The  action  column  of  the  predicate-action  table  identifies  the  variable  changes  that  must 
take  place  when  the  transition  is  executed.  The  program  captures  the  essence  of  the 
predicate-action  table  by  breaking  the  components  of  the  table  into  subprograms.  A 
subprogram  in  the  Ada  environment  is  a  function,  procedure,  or  package.  Since  the  user 
must  have  access  to  a  number  of  the  subprograms  they  are  represented  as  separate 
compilation  units. 
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The  first  subprogram  is  the  Analyze  PrecUcate  function.  A  function  is  a 
subprogram  that  returns  a  value  to  the  location  in  which  it  was  invoked.  It  can  only  have 
input  parameters.The  function  is  handed  the  machine  local  variables  and  the  system  global 
variables  as  input  parameters.  Since  more  than  one  transition  could  be  enabled,  a  stack  is 
used  to  place  all  transitions  that  are  enabled.  A  transition  is  pushed  onto  the  stack  if  it  is 
enabled  and  the  function  returns  the  entire  transition  stack.  From  the  transition  stack 
values  and  a  pointer  to  the  current  state  in  machine  adjacency  matrix,  a  determination  is 
made  on  which  transition  can  actually  be  executed.  There  are  a  number  of 
Analyze _Predicate  functions,  one  for  each  machine.  The  template  for  the 
Analyze _Pre(Ucate  function  is  shown  in  Figure  21. 

separate  (main) 

function  Analyze_Predicate3_Machinel (local  :  machinel_3tate_type; 

GLOBAL:  global_variable_type) 
return  tran3ition_3tack_package. stack  is 

begin 


MakeEmpty (tran3ition_3tack) ; 
if  ( 


_  )  then 

Push (tran3ition_stack, 
end  if;  ~ 

return  tran3ition_3tack; 
end  Analyze_Predicate3_Machinel; 


enabling  condition 

)  ; 

enabled  transition 


Figure  21:  SCM,  Analyze  Predicate  function  template. 

Once  a  transition  is  executed,  changes  must  be  made  to  some  or  all  the  variables. 
A  procedure  using  a  case  statement  was  the  simplest  way  to  make  the  changes  to  the  global 
state  record.  The  Action  procedure  has  three  parameters:  the  transition  that  is  executed  and 
the  current  global  state  record  are  in  parameters,  and  the  updated  global  state  record  is  the 
out  parameter.  The  transition  is  passed  into  the  procedure  and  a  case  statement  determines 
which  series  of  instructions  are  to  be  executed.  These  instructions  make  the  appropriate 
changes  to  the  prottxol  environment  variables.  The  out  system  state  is  handed  out  of  the 
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procedure  containing  the  changed  protocol  variables.  The  template  for  the  Action 


procedure  is  shown  in  Figure  22. 


separate  (main) 
procedure  Action ( 


begin 


in_3ystem_3tate 

in_tran3ition 

out_3y3tem_3tate 


case  (in_tran3ition)  is 
when  ( 


in  Gstate_record_type; 
in  3cm_transition_type; 
out  G3tate_record_type)  is 


enabled  transition 


when 

end  case; 
end  Action; 


action  taken 


others  -> 

put_line ("Error  in  the  Action  procedure"); 


Figure  22:  SCM,  Action  procedure  template 

The  three  subprograms  that  reflect  the  logic  of  the  predicate-action  table  are 
grouped  together  in  one  file  (predicate_action.a).  The  file  for  the  stop  and  wait  protocol 
is: 


separate  (main) 

function  Ana lyze_Predicates_Machinel (local  ;  machinel_state_type; 

GLOBAL:  global_variable_type) 
return  transition_3tack_jpacJcage . stac)c  is 

begin 

MalceEmpty (transition  stack); 

if  (  (local. out__bu£f  7*  e)  and  ((HOBAL . CHAN  »  K))  then 
Push  (tran3ition_3tack,  aait_data)  ; 
end  if; 

if  (GLOBAL. RET  a  A)  then 

Push  (transition_stack,  rc7__ack)  ; 
end  if;  ” 

return  transition_stack; 
end  Analyze_Predicates_Machinel ; 

separate  (main) 

function  Analyze_Predicates_Machine2 (local  :  machine2_state_type; 

GLOBAL:  global_variable_type) 
return  transition_stack_package . stack  is 

begin 

MakeEmpty (transition_stack) ; 

if  ( (GLOBAL. CHAN  />  E)  and  (local . inJOuff  »  e) )  then 
Push (transition_3tack, rcy_data) ; 
end  if; 

Push (tran3ition_3tack,3nBt_ack) ; 
return  tran3ition_3tack; 
end  Analyze_Predicate3_Machine2 , separate  (main) 

separate  (main) 
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procedure  Action (in  3y3tein_3tate  :  in  G3tate_record_type; 

Tn_tran3ition  :  in  3cm_tran3ition_type; 

out_3y3tem_3tate  :  out  G3tate_record_type)  ia 

begin 

case  (in_tran3ition)  ia 
when  (xmt  data)  »> 

out~system_st ate . GLOBAL_VARIABLES . CHAN  : » 
in_3yatam_atate  .inachinel_3tata .  outjbuff  ; 
when  (rcT  ack)  •> 

out^ayatem  atate.6L0BAL_VARIABLBS .RET  :»£; 
out_ayateBratata.GLOBAli_VARIABLES.C:HAN  :aB; 
out~ayatam_atate .marh i na2_atata . in_buf £ 
when  (aint_ack)  => 

out_ayatam_atata.GLOBAL_VARXABLBS.RET  A; 
when  (rcv^data)  »> 

out^ayatem  atata . marh i na2_at ata . in_buf f  := 
in_ayatam_at  ate .  GLOBAL_VARIABLES .  CH2^  ; 
when  othera  •> 

put_line (“Error  in  the  Action  procedure"); 

end  caae; 
end  Action; 


Figiire  23;  SCM,  analyze_pre(licate.a,  stop_and_wait. 

The  bold  text  in  the  code  indicates  what  the  user  provided  as  input  to  define  the 
specification  shown  in  the  stop  jind_wait  predicate-action  table  (See  Figure  16.) 

3.  Finite  State  Machines 

The  FSM’s  are  input  as  a  text  file  during  program  execution.  This  file  is  built  by 
the  user  with  a  set  of  language  rules  similar  to  the  Backus-Naur  Form  (BNF)  shown  in 
Chapter  in.  The  only  change  to  the  fonnat  of  the  input  is  the  transition  (trans)  lines.  In  the 
GFSM  model  only  send  and  receive  transitions  were  allowed;  whereas  in  the  SCM  model 
a  transition  can  have  any  label  that  follows  the  enumeration  rules.  The  lines  of  the  text  file 
are  buffered  and  parsed.  From  the  parsed  line  groups  of  strings  called  tokens  are 
manipulated  as  described  in  Chapter  HI.  The  list  of  valid  instructions  for  finite  state 
machine  input  is: 


3tart 

machine 

3tate 

initial_^3tate 
trana 
f iniah 


<natural> 

<natural> 

<natural>  <natural> 

<enuraeration  litetal>  <natural> 
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The  tokens  are  cast  into  either  enumerated  types  (instructions)  or  integers  (integer 
variables).  The  integer  variables  have  been  formally  defined  within  the  main  procedure  in 
Appendix  B.  The  meaning  of  the  instructions  are  found  in  Figure  24.  * 


start 

machine 

state 

initial_atace 

trans 

finish 


Serves  as  a  beginning  flag  for  the  file. 
Defines  the  current  machine. 

Defines  the  current  state. 

The  intitial/start  state  for 
machines  one  and  two. 

Transition  type  and  next  state . 

This  token  serves  as  an  ending  flag  for 
the  file. 


Figure  24:  Input  File  definitions. 


Representation  of  a  finite  state  machine  using  the  above  convention  has  some 

inherent  constraints.  Rules  for  constructing  enumeration  literals  must  be  followed.  For 

instance,  the  list  of  values  in  an  enumeration  literal  can  only  be  character  literals  and  cannot 

contain  a  digit  in  the  first  position.  The  input  file  for  stop  and jivait  is  shown  in  Figure  25: 

start 
machine  1 
state  0 

trans  xmt_data  1 
state  1 

trans  rcv_ack  0 
machine  2 
state  0 

trans  rcv_data  1 
state  1 

trans  xmt_ack  0 
initial_state  0  0 
finish 

Figure  25:  SCM,  Input  File,  stop  and  wait. 

A  data  structure  that  contributes  to  the  reachability  analysis  is  the  FSM  adjacency 
list.  The  adjacency  list  was  chosen  as  the  structure  to  represent  the  directed  graph  of  the 
finite  state  machines. 

The  actual  data  structure  to  build  the  adjacency  list  and  the  defined  constraints 


are: 


type  machine_array_record_type; 

type  Mlink__type  is  access  machine_array_record_type; 
type  executed_type  is  (yes, no); 
type  machine_array_record_type  is 
record 

transition  :  3cm_transition_type ; 
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next_state  :  natural; 

executed  :  executed_type; 

Mlinlc  :  Mlinlc_type 

end  record; 

type  inachine_array_type  is  array  (positive  rangeo) 
of  Mlink_type; 

type  systein_array_type  is  array(1..2) 
of  machine  array_type; 

The  internal  representation  of  the  FSM  adjacency  lists  are  the  same  as  Figtue  12 
except  the  SCM  adjacency  lists  do  not  have  a  message  field 

C.  REACHABILITY  ANALYSIS 

The  process  of  generating  the  set  of  all  states  reachable  from  the  initial  state  is  called 
state  reachability  analysis.  During  the  reachability  analysis  a  check  for  deadlock, 
unspecified  reception,  and  unexecuted  transitions  are  done.  The  reachability  analysis  of  a 
specific  protocol  is  done  in  two  phases. 

The  first  is  to  generate  a  global  state  reachability  graph.  This  analysis  cons&ucts  a 
graph,  whose  nodes  are  the  reachable  global  states,  and  whose  arcs  indicate  the  transitions 
leading  from  each  global  state  to  another.  The  global  state  (node)  contains  the  state  of  each 
machine  and  the  values  of  all  the  variables. 

The  second  phase  of  the  analysis  is  to  generate  an  separate  system  state  reachability 
graph  from  the  global  state  reachability  graph.  The  system  reachability  graph  contains 
nodes  with  just  the  state  information  of  each  machine.  The  rules  for  the  generation  of  new 
states  will  be  discussed  in  Section  2. 

1.  Global  State  Analysis 

The  process  of  generating  the  set  of  all  global  states  reachable  from  the  initial 
global  state  is  called  global  state  analysis.  This  analysis  produces  a  graph,  whose  nodes  are 
the  reachable  global  states,  and  whose  arcs  indicate  the  transitions  leading  from  each  global 
state  to  another.  The  global  state  of  a  system  consists  of  the  system  state  tuple,  plus  the 
values  of  all  variables,  both  local  and  shared.  The  algorithm  as  it  appears  in  [LUND  9 1  a]  is: 
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(1)  Set  each  machine  to  its  initial  state,  and  ail  variables  to  their  initial 
values.  The  initial  set  of  reachable  global  states  consists  of  the  initial  system 
state  and  the  value  of  all  variables;  the  initial  graph  is  a  single  node 
representing  this  state. 

(2)  From  the  current  global  state  vector  and  variable  values,  determine 
which  transitions  are  enabled.  For  each  of  these  transitions,  determine  the 
global  state  which  results  ^m  its  execution.  If  this  state  (with  the  same 
enabled  transitions)  has  already  been  generated,  then  draw  an  arc  from  the 
current  state  to  it,  labeling  the  arc  with  the  transition  name.  Otherwise,  add 
the  new  global  state  to  the  graph,  draw  an  arc  from  the  current  state  to  it,  and 
label  the  arc  with  the  name  of  the  transition. 

(3)  For  each  new  state  generated  in  step  2,  repeat  step  2.  Continue  until 
step  2  has  been  repeated  for  each  global  state  thus  generated,  and  no  more 
new  states  are  generated. 


The  algorithm  above  was  modified  to  make  use  of  the  existing  data  structures 
introduced  in  the  CFSM  program.  A  psuedo-code  algorithm  to  construct  the  global 
reachability  graph  is: 


create  topjjstate  pointer  and  initial  node  in  Gstate  graph 
main  loop~ 

for  machine  index  in  I .  .number  jjfjnachines  loop 

tran^tionjtack Analyze j>redicate(machineJndex.current_Gstate) 
while  transition_stack  is  not  empty  loop 

while  current  row  of  mac hine( machine  Jndex)  is  not  null  loop 
if  currentjGstate. transition  =  top  of  transition  stack  then 

perform  Action  procedure  on  current  Gstate  and  place 
results  in  a  temp  Gstate 
search  Gstate  graph  for  temp  Gstate 
if  temp  Gstate  found  then 

Insert  temp  Gstate  in  Gstate _graph 

Enqueue  pointer  to  location  in  Gstate  jwinter  queue 

else 

link  current  Gstate  to  found  Gstate 
set  new  node  flag  to  false 

else 

traverse  current  row  of  machine(machine  Jndex) 
end  loop  —machine  row  traversal  loop 
Pop  a  transition  from  the  transition  stack 
end  loop  -transition  loop 
if  the  Gstate  jwinter  jqueue  is  not  empty  then 
Dequeue  a  pointer 

go  to  the  appropriate  row  of  maclunei  machine  Jndex) 

else 

exit  loop 

end  loop  -machine  loop 
exception 

when  Gstate  jwinter  queue  is  empty  then 
exit  main  loop~ 
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when  Gstcue  j>oinur_queuie  is  full  then 
print  error  meJsage 
exit  main  loop 

end  mainjoop 


The  data  structures  that  are  used  in  the  program  are  defined  in  the  specification 

of  the  mean  procedure  and  the  definitions  package.  The  machine  states  and  variables  along 

with  the  global  variables  are  defined  in  the  definitions  package.  The  remaining  data 

structures  which  are  hidden  from  the  user  are:shown  in  Figure  26 

— data  structures  for  the  global  state  tuple (node) 
type  global_state_type; 

type  Glink_type  is  access  global_state_type; 

—transition  structure 
type  Gstate_transition_type  is 
record 

Gtransition  :  scm_tran3ition_type; 
new_node  :  boolean  true; 

Glink  :  Glink_type; 

executed  :  boolean  :»  false; 

end  record; 


— global  tuple  structure 
type  Gstate_record_type  is 
record  " 

machinel_state  :  machinel_state_type; 

machine2_state  :  raachine2_state_type; 

global_variable3  :  global_variable_type; 

end  record; 


— Global  state  node,  contains  transition,  state,  and  link  information 
— needed  for  building  the  global  state  graph 
type  global_3tate_type  is 
record 


node_n umber 

Gtuple 

linkl 

link2 

link3 

link4 

end  record; 


natural  :•  0; 

G3tate_record_type ; 

G3tate_transition_type; 

G3tate_tran3ition_type; 

Gstate_tran3ition_type; 

G3tate_transition_type; 


Figure  26:  SCM,  global  definitions. 

The  data  structure  of  the  global  node  {global _state_type)enczpsul3itcs  the 
information  contained  in  the  global  state  record.  The  global  transition  record  has  the  type 
of  transition  and  information  about  the  node  it  is  pointing  to.  If  the  node  it  is  pointing  to  is 
a  newly  created  node  the  new  field  is  set  to  false,  otherwise  it  maintains  its  initialized  value 
of  true.  It  also  has  a  visited  field,  used  during  the  construction  of  the  system  state 
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reachability  graph.  The  internal  representation  of  the  graph  generated  by  the  algorithm  for 
stop_and_wait  protocol  highlights  all  the  data  strucnue  used  (see  Figure  27). 
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Figure  27:  SCM  internal  global  reachability  graph,  stop _and  wait. 
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2.  System  State  Analysis 


System  state  analysis  is  similar  to  global  state  analysis.  The  number  of  states 
generated  by  the  system  state  analysis  is  less  than  or  equal  to  the  number  of  states  in  the 
CFSM  model  or  the  global  analysis  of  the  SCM  model.  Only  the  states  of  the  machines  and 
the  transitions  from  those  states  are  considered  when  generating  a  new  state.  The  formal 
steps  in  constructing  a  system  state  graph  as  it  appears  in  [LUND  91a]  is: 


(1)  Set  each  machine  to  its  initial  state,  and  all  variables  to  their  initial 
values.  The  initial  set  of  reach^le  system  stales  consists  of  only  the  initial 
system  state;  the  initial  graph  is  a  single  node  representing  this  state. 

(2)  From  the  current  system  state  vector  and  variable  values,  determine 
which  transitions  are  enabled.  For  each  of  these  transitions,  determine  the 
system  state  which  results  from  its  execution.  If  this  state  (with  the  same 
enabled  transitions)  has  already  been  generated,  then  draw  an  arc  from  the 
current  state  to  it,  labeling  the  arc  with  the  transition  name.  Otherwise,  add 
the  new  system  state  to  the  graph,  draw  an  arc  from  the  current  state  to  it,  and 
label  the  arc  with  the  name  of  the  transition. 

(3)  For  each  new  state  generated  in  step  2,  repeat  step  2.  Continue  until 
step  2  has  been  repeated  for  each  system  state  thus  generated,  and  no  more 
new  states  are  generated. 

The  portion  of  the  program  that  builds  the  system  state  graph  makes  use  of  the 
information  already  available  in  the  global  state  graph.  In  the  current  version  of  the 
program  the  global  reachability  graph  is  constructed  followed  by  the  system  reachability 
graph.  Future  versions  would  allow  the  user  to  select  which  analysis  to  perform  but 
currently  both  are  constructed  and  output  The  pointer  to  the  initial  global  state  is  provided 
as  an  input  parameter  to  the  build_Sstate_graph  procedure.  The  global  state  graph  is 
traversed  in  a  breadth  first  manner,  as  the  nodes  are  visited  the  system  state  graph  is 
constructed.  If  the  system  state  graph  were  being  constructed  independently  of  the  global 
state  graph  the  algorithm  would  be  very  similar  to  the  one  in  the  previous  section.  Since  the 
system  state  graph  is  being  constructed  based  on  only  the  global  reachability  graph  the 
machine  matrices  are  not  used.  The  psuedo-code  algorithm  for  this  approach  is: 
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create  topJSstate  pointer  and  build  initialJSstate  node; 
main  toop~ 

while(  current  GstateJink  not  null  and  not  visited)  loop 
visit  a  (Jstatejgraph  node  using  BFS  traversal 
mark  the  link  taken  as  visited 
create  a  temp_Sstate  with  values  of  currentJGstate 
search  Sstatejraph  for  tempJSstate 
^temp  Sstate  found  then 

Insert  temp_Sstate  in  Sstate  jgraph 
else 

link  current  Sstate  to  found  Sstate 
set  new_no3e  flag  to  false 

end  loop 
end  main  loop 


The  data  structures  for  the  system  state  graph  construction,  except  for  the 
transition  labels,  are  completely  hidden  from  the  user.  The  system  related  data  structures  as 
they  appear  in  the  main  procedure  are  shown  in  Figure  28. 


type  ay3tem_atate_type; 

type  Syalink_type  ia  acceaa  ayatem_3tate_type; 

— tranaition  atructure  for  ayatem  atate 
type  Setate_tran3ition_type  ia 
record 

Stranaition 
new_node 
SyaTink 

end  record; 

type  S3tate_record_type  ia 
record 

machine l_3t ate 
machine2_state 

end  record; 


:  3cm_tran3ition_type; 
:  booTean  :«  true; 

:  Syslink_type; 


:  natural  :»  0; 
:  natural  :«  0; 


— ayatem  atate  atructure 
type  3y3tem_3tate_type  ia 
record 

node_n umber 

Stuple 

linkl 

link2 

link3 

link4 

end  record; 


:  natural  :=  0; 

:  S3tate_record_type; 

:  S3tate_tran3ition_type; 
:  S3tate_tran3ition_type; 
:  S3tate__tr’'’oition_type; 
:  S3tate_tran3ition_type; 


Figure  28:  SCM,  system  definitions. 


To  follow  through  with  the  stop_and_wait  analysis  example,  an  internal 
representation  of  the  system  state  graph  is  shown  in  Figure  29.  Although  this  example  does 
give  a  graphical  picture  of  how  the  data  structures  are  used  it  does  not  show  the  advantages 
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of  a  system  state  analysis  over  global  state  analysis.  Examples  covered  in  Chapter  V 
illustrate  how  much  smaller  system  state  graphs  can  be  when  compared  to  the  global 
analysis  graphs. 
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Figure  29:  SCM  internal  system  reachability  graph,  stop  and  wait. 
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D.  OUTPUT 


Output  of  the  analysis  is  provided  to  a  text  file  and  to  a  default  device( workstation 
display).  Figure  32  shows  a  captured  image  of  default  output  to  a  workstation  screen  for 
stop  and  wait.  There  are  features  available  to  allow  the  user  to  step  through  the  output  one 
screen  at  a  time.  Output  messages  are  provided  to  the  user  when  a  deadlock,  unexecuted 
transition,  or  an  unspecified  reception  occur.  A  message  is  also  displayed  when  the  length 
of  the  graph  exceeds  the  bounds  defined  by  the  user  (capacity  of  the  channel  is  exceeded.) 
The  contents  of  the  machine  adjacency  lists  are  also  output. 

The  user  may  format  output  for  the  global  state  graph.  This  is  done  through  the  file 
user_ouput.a.  The  procedure,  output _G tuple,  contained  in  the  file  allows  the  user  to  format 
the  variables  for  default  output.The  template  for  output  procedures  are  found  in  Figure  30. 


separate  (main) 

procedure  output_Gtuple (tuple  :  in  out  G3tate_record_type)  is 
begin 

put('*  ["  &  integer' image  (tuple  .machinel_state. state_nuinber)  &  "  ,  ")  ; 


user  defined  format  of  variables  using  text_IO 


puti”  , "  4  integer' image (tuple .machine2_3tate . state_number)  &  "  ]  "); 
end  output_Gtuple; 


separate  (main) 

procedure  output_Gtuple_to_file (tuple  :  in  out  G3tate_record_type)  is 
begin 


put(reach,"  ("  &  integer' image (tuple .machinel_3tate . 3tate_number) ) ; 


user  defined  format  of  variables  using  text_IO 


put (reach,"  &  integer' image (tuple .machineZ_state . state_number)  & 

"  ]  ")  ; 

end  output_Gtuple_to_f ile; 


Figure  30;  SCM,  output  Gtuple  prtxedure  template. 


An  example  of  how  a  user  could  format  output  is  given  for  the  stop_and_wait  protocol 
is  given  in  Figure  3 1 
separate  (main) 

procedure  output_Gtuple (tuple  :  in  out  G3tate_record_type)  is 
begin 

put("  ["  4  integer' image (tuple .machinel_state . 3tate_number) 

4  “  ,  ")  ; 

put (tuple. machine l_st ate. out_buff,  set  »>  lower_case) ; 
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putC*  ,  '); 

put (tupla. GLOBAL  VARIABLES . CBAM,  set  »>  upper_ca8e) ; 
putC"  ,*); 

put  (tuple.  GLOBAL^VARIABLBS.RXT,  set  »>  upper_ca8e)  ; 
put(’*  ,  *) ;  "■ 

put  (tuple. atecblne2_state.in_bu££,  set  •>  lower_case) ; 

put(”  4  integerHjnage  (tuple -machine2_3tate. State  number) 

4  "  ] 

end  output_Gtuple; 
separate  (main) 

procedure  output_Gtuple_to_file (tuple  :  in  out  G3tate_record_type)  is 
begin 


put (reach,"  ("  4 

integer' image (tuple .machinel_3tate . 3tate_number)  4  ”  ,  "); 

put  (reach,  tuple  .machlnel_state.out_bu££,  set  *>  loi«er_case)  ; 
put (reach, "  ,*); 

put  (reach,  tuple. GLOBAL_VARZABLBS. CHAM,  set  «>  upper_case)  ; 
put (reach, "  ,  •); 

put (reach, tuple. GLOBAL_VARIABLKS. RET,  set  a>  upper_case) ; 
put (reach,"  ,  *); 

put (reach, tuple. aachlne2_st ate. ln_bu££,  set  3b>  lower_case) ; 
put (reach, "  ,  "  4 

integer' image (tuple .machine2_3tate, 3tate_number)  4  "  ]  ")  ; 
end  output_Gtuple_to_f ile; 

Figure  31:  S(3M,  output  format,  stop_and_wait. 

a 

Consistent  with  previous  examples  the  boldface  code  is  that  which  the  user 
provides.  The  user  does  not  provide  any  parameters  for  system  state  output.  The  output 
shown  in  Figure  32  was  formatted  according  to  the  procedures  u^ed  above. 
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REfOttBILITY  MWLYSIS  of  :  stop.and.Mit 
Global  SUte  Gim 


0  tO,d,E,E,a,0]  xnt.data 

1  [l,d,D,E,8,0]  rcw.data 

2  [l,d,D,E.d,l]  xnt_adc 

3  [l,d,D^A,d,0]  rcv.ack 


1 

2 

3 

0 


Systaa  State  GI»PH 


0 

C  0 

.  0  ] 

xnt.data 

[1,01 

1 

1 

C  1 

.  0  ] 

rcv.data 

[1,11 

2 

2 

1 1 

,  1  ] 

xnt.ack 

t  1  ,  0  1 

3 

3 

( 1 

.  0  ] 

rcv.ack 

[0,0] 

0 

Machine  1  Array  Contents 


I  froa  I  To  I  Transition  I  Executed  I 


I  0  I  1  I  xnt.data  I  yes  I 

I  1  1  0  I  rcv.ack  I  yes  I 


I  Machine  2  Array  Contents  I 


I  Fron  I  To  I  Transition  I  Executed  I 


I  1  I  rcv.data  I  yes  I 

I  0  I  xnt.ack  I  yes  I 


Figure  32;  SCM,  analysis  output,  stop  and  wait. 
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V.  AN  AUTOMATED  ANALYSIS  OF  SELECTED  DATA  LINK 

PROTOCOLS 


In  this  section  the  programs  that  were  developed  in  the  last  two  chapters  will  be 
demonstrated.  Some  well  known  data  link  protocols  will  be  analyzed  using  the  CFSM  and 
SCM  programs.  The  OSM  program  will  be  used  to  analyze  the  alternating  bit  and  the 
sliding  window  protocols.  The  SCM  program  will  be  used  to  analyze  go_back_n  and 
selective  repeat  protocols.  In  each  analysis  the  specification  will  be  described;  the  program 
input  and  results  are  in  the  Appendices  of  this  publication. 

A.  CFSM  MODEL 

The  examples  used  as  input  show  the  advantages  of  the  CFSM  program.  The 
alternating  bit  protocol  analysis  was  chosen  as  a  simple  class  of  protocols.  The  sliding 
window  with  a  window  size  of  three  shows  how  a  graphically  complex  protocol  can  be 
analyzed  quite  easily. 

1.  Alternating  Bit  Protocol 

The  specification  of  the  alternating  bit  protocol  will  be  used  as  the  first  example 
for  the  CFSM  program.  The  protocol  consists  of  two  machines.  Machine  one  serves  as  a 
sender  and  Machine  two  as  the  receiver.  The  sender  sends  a  message(-X)  to  the  receiver. 
The  receiver  then  accepts  the  message  (+X)  and  sends  an  acknowledgment  (-A).  The 
acknowledgment  at  the  machine  level  is  done  with  the  toggling  of  a  bit,  wherein  the  name 


alternating  bit  is  derived.  The  sender  is  clear  to  send  another  message  when  the 
acknowledgment  is  received. 


Machine  I  Machine  2 


Figure  33:  CFSM  specification.  Alternating  Bit. 

The  input  file  for  the  specification  is 

start 
Machine  1 
state  1 
trans  -X  2 
state  2 
trans  ♦fi  3 
state  3 
trans  -Y  4 
state  4 
trans  *8  I 
machine  2 
state  1 
trans  *X  2 
state  2 
trans  -A  3 
state  3 
trans  ♦Y  4 
state  4 
trans  -B  1 
initial.state  1  1 
finish 


The  analysis  of  the  alternating  bit  specification  is; 
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REACHABILITY  ANALYSIS  of 


output.alt.bit 


1 

[  1  ,  E  ,  E  ,  1  ] 

-X 

I  2  ,  X  ,  E  ,  1  ] 

2 

2 

C  2  .  X  ,  E  ,  1  ] 

♦X 

[  2  ,  E  ,  E  ,  2  I 

3 

3 

C  2  ,  E  ,  E  ,  2  ] 

-A 

[  2  ,  E  ,  A  ,  3  ] 

4 

4 

[  2  ,  E  ,  A  ,  3  ] 

♦A 

I  3  ,  E  ,  E  ,  3  ] 

5 

5 

C  3  ,  E  ,  E  ,  3  I 

-Y 

I  4  ,  Y  ,  E  ,  3  ] 

6 

6 

C  4  ,  Y  ,  E  ,  3  1 

♦Y 

I  4  ,  E  ,  E  ,  4  ] 

7 

% 

7 

C  4  .  E  ,  E  ,  4  I 

-B 

C  4  ,  E  ,  B  ,  1  I 

8 

8 

C  4  ,  E  .  B  ,  1  ] 

♦B 

I  1  ,  E  ,  E  ,  1  I 

1 

1  Hachine  1  Array  Contents  1 

1  Froa 

1  To 

Transition  1 

Executed  1 

1  1 

1  2 

snd  X  1 

yes  1 

1  2 

1  3 

rev  A  1 

yes  1 

1  3 

1  4 

snd  Y  1 

yes  1 

1  4 

1  1 

row  B  1 

yes  t 

1  Machine  2  Array  Contents  1 

1  Froa 

1  To 

Transition  1 

ixecuted  1 

1  1 

1  2 

rev  X  1 

yes  1 

1  2 

1  3 

snd  A  1 

yes  1 

1  3 

1  4 

rev  Y  1 

yes  1 

1  4 

1  1 

snd  B  1 

yes  1 

«  The  nodes  generated  bg  the  analysis 
were  done  in  a  breadth  first  i»anner 


2.  A  More  Complex  Example:  The  Sliding  Window  Protocol. 

The  analysis  of  a  sliding  window  protocol  is  a  more  complex  example.  To 
represent  the  protocol  as  a  set  of  graphical  finite  state  machines  can  be  quite  tedious.  The 
essence  of  the  protocol  must  be  captured  with  the  use  of  transitions,  oftentimes  this  can  lead 
to  an  intricate  diagram  as  in  this  example. 

The  sliding  window  protocol  can  also  be  represented  as  a  two  machine  CFSM. 
As  in  the  previous  example.  Machine  one  is  the  sender  and  Machine  two  is  the  receiver.  At 
any  instant  of  time  the  sender  maintains  a  list  of  consecutive  sequence  numbers 
corresponding  to  frames  it  is  permitted  to  send[TANE  81]  These  frames  are  said  i-  fall 
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within  the  sending  window.  The  receiver  also  maintains  a  receiving  window  corresponding 
to  frames  it  is  permitted  to  accept  The  sending  window  and  the  receiving  window  need  not 
have  the  same  lower  and  upper  limits,  or  even  have  the  same  size. 

A  window  size  of  three  is  used  in  the  specification  given  in  Figure  34.  The 
messages  or  packets  are  shown  as  transitions  labeled  X,  Y,  and  Z  and  the  acknowledgments 
are  A,  B,  and  C. 

Machine  I  Machine  2 


Figure  34:  CFSM  specification,  sliding  window  (w=3). 
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The  text  file  of  the  specification  is: 


start 
Mchina  1 
state  1 
trsns  -X  2 
state  2 
trans  +8  7 
trsns  -Y  3 
state  3 
trim  *8  9 
trsns  *C  4 
state  4 
trsns  -Z  5 
state  5 
trsns  -X  6 
trans  ^  1 
state  6 
trsns  *9  2 
trsns  *8  7 
state  7 
trsns  -Y  8 
state  8 
trsns  -2  9 
state  9 
trsns  *C  S 
trsns  *9  1 


Mchlns  2 
state  1 
trm  *X  2 
state  2 
trans  ‘Y  3 
state  3 
trsns  -C  4 
state  4 
trans  <2  5 
state  S 
trans  ‘X  6 
state  6 
trans  -I  7 
stats  7 
trans  *Y  8 
state  8 
trans  *Z  9 
state  9 
trsns  -9  1 
inltlal.state  1  1 
finish 


The  analysis  of  the  specification  as  contained  in  the  output  text  file 

WOMILITY  rwLnts  or  :  auouc.siidms 
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•Y 
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5 

s 
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*V 
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a  E  a  C  a 

4  ) 

< 

(  4 

E  .  E  ,  4  1 
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i 
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The  unexecuted  transitions  account  for  error  control.  Error  control  refers  to 
mechanisms  to  detect  and/or  correct  errors  that  occur  in  the  transmission  of  information.  So 
the  unexecuted  transitions  identiEed  in  Machine  2’s  array  are  transitions  that  would  have 
been  executed  if  a  loss  of  a  message  had  occurred.  Error  and  time-out  transitions  are  not 
shown  in  the  CFSM. 

B.  SCM  MODEL 

The  examples  used  as  input  validate  the  use  of  the  SCM  program  as  a  tool  to  verify 
protocols.  The  goJ)ack_n  protocol  was  analyzed  first  due  to  the  availability  of  prior 
modelling  done  using  SCM.  The  output  of  the  program  were  compared  to  the  manual  SCM 
modelling  results  of  this  protocol.  The  selective  repeat  specification  provided  additional 
evidence  as  to  the  programs  validity  as  well  as  demonstrating  how  it  can  be  used  to  improve 
a  specification.  In  both  examples  it  must  be  shown  that  the  use  of  the  analysis  should  help 
the  designer  or  reviewer  to  gain  a  greater  understanding  of  the  protocol,  as  well  as  in 
detecting  errors. 

The  analysis  of  any  protocol  using  this  program  contains  varying  information.  A 
global  reachability  graph  and  system  reachability  graph  are  provided.  Following  the  graph 
is  a  description  of  the  contents  of  each  machine  array  upon  termination  of  the  graph 
construction.  Error  messages  (deadlock,  unspecified  reception,  and  unexecuted  transitions) 
are  placed  at  the  point  in  the  analysis  where  they  occur.  The  system  state  graph  will  be  used 
in  this  section  to  provide  a  means  to  validate  output  results.  The  system  state  graph  can  be 
viewed  as  a  three  dimensional  object  whose  tuple  values  provide  a  vector  to  3  dimensional 
space. 

1.  Go  Back  N 

The  first  protocol  which  was  chosen  to  model  is  a  go_back_n  protocol  with  a 
variable  window  size,  which  is  a  subset  of  the  High-level  Data  Link  Control  (HDLC)  class 
of  protocols.  There  are  two  machines  in  the  system,  a  sender(m;)  and  a  receiver  (m2).  The 
sender  sends  data  blocks  to  the  receiver,  which  are  numbered  sequentially,  0, 1,...,  w,  0, 1,... 
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for  a  window  size  of  w.  The  maximum  number  of  data  blocks  which  can  be  sent  without 
receiving  an  acknowledgment  is  w,  the  window  size.The  receiver,  m2,  receives  the  data 
blocks  and  acknowledges  them  by  sending  the  sequence  number  of  the  next  block  expected 
(which  is  stored  in  local  variable  exp).  The  shared  variables  DATA  and  SEQ  are  used  to 
pass  messages  from  sender  to  receiver,  and  the  shared  variable  ACK  is  used  to  pass 
acknowledgments  back  to  the  sender.  The  receiver  may  acknowledge  any  number  of  blocks 
received  up  to  the  window  size.  Upon  receiving  the  acknowledgment,  the  sender  must  be 
able  to  deduce  how  many  data  blocks  are  being  acknowledged.  This  is  done  by  observing 
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the  difference  between  the  values  of  the  received  acknowledgment  and  the  sequence 


number  of  the  last  data  block  sent. 


machine  1 


seq  :  ( 0 , 1  , ,  w  ) 
i :  (  1 , 2  , ,  w  ) 


machine  2 


Rdata :  I  I 

exp  :  ( 0 , 1 , ... ,  w  ) 
j :  (  1 , 2 . w  ) 


Transition 

Enabling  Predicate 

Action 

-D 

DATA(i)=E  A  SEQ(i)=E 

DATA(i) .  *  Sdataii) 

SEQ(i)  .  =  seq 
inc(ijeq) 

(QSk<w) 

ACK9k  =  seq  A 

ACK*E 
(next  state  :  k) 

ACK  .  =  E 

+D 

DATA  (j)  *E  A  SEQ(j)-exp 

Rdata  DATA(j) 

DATA(j).  SEQij)  .  =  £ 
inc(j.exp) 

■A 

DATA(j)=E 

ACK  exp 

Figure  35:  SCM  specification,  Go  BackN,  window  size  of  l..w. 
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The  general  specification  of  the  protocol  is  given  in  Figure  35.  Included  in  this 
figure  are  the  state  machine  diagrams,  variables  and  the  predicate  action  table.  Initially, 
both  sender  and  receiver  are  in  state  0,  arrays  DATA  and  SEQ  are  empty,  and  ACK  is 
empty.  The  domains  of  DATA,  Rdata  and  Sdata  are  not  specified;  these  are  used  to  hold 
user  data  blocks.  Sdata  and  Rdata  are  the  interface  or  access  points  of  the  higher  layer  (user) 
protocol.  The  local  variables  for  the  sender  are  Sdata,  used  to  store  data  blocks,  seq,  used 
to  store  the  sequence  number  of  the  next  data  block  to  be  sent  out,  and  i,  used  as  an  index 
into  the  DATA  and  SEQ  arrays.  Initially  seq  is  set  to  0,  and  i  is  set  to  1.  The  local  variables 
of  the  receiver  are  Rdata,  exp,  and  j.  Rdata  is  used  to  receive  and  store  incoming  data 
blocks,  exp  to  hold  the  expected  sequence  number  of  the  next  incoming  data  block,  and  j  is 
an  index  into  the  shared  arrays  DATA  and  SEQ. 

There  are  four  basic  types  of  transitions  described  in  the  predicate  action  table. 
In  the  sender  the  -D  transition  transmits  a  data  block  by  placing  it  into  the  shared  variable 
“  DATA(i),  and  the  sequence  number  into  SEQ(i).  The  send  is  enabled  whenever  those 
variables  are  empty.  The  receive  transition  in  the  receiver,  m2,  is  enabled  whenever  a  data 
block  of  the  appropriate  sequence  number  is  in  the  jth  element  of  DATA  and  SEQ.  An 
acknowledgment  may  be  sent  by  m2  in  any  state  except  0,  in  which  case  no 
unacknowledged  data  blocks  have  been  received.  The  +4  is  a  receive  transition.  If  mj  is  in 
state  u,  1  s  u  ^  w,  and  there  is  a  nonempty  value  in  shared  variable  ACK,  then  exactly  one 
of  the  transitions  -^Aq,  +-4;,...,  +<4^/-;  ^  enabled;  it  will  be  that  Aj^  such  that  the 

predicate  ACK®k  =  seq  is  true,  and  the  next  state  is  k.  In  the  state  diagram,  all  of  the 
transition  +Ai^aie  shown  using  the  same  vertical  line. 

a.  Input  of  variable  definitions. 

A  sample  interacuon  using  the  program  for  Uie  analysis  of  go_back_n,  w=l, consists  of  input 
files  and  an  output  file.  The  variable  definitions  contained  in  the  user  specification  file  are: 
package  definitions  is 

type  scm_transition_type  is  (snd_data,  rcv_data, 

snd  ack,  rev  ackO,  unused) ; 
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type  buffer_type  is  (d,e,a); 

type  buf fer_array_type  is  array(l..l)  of  buffer_type; 
type  seq_ari^ay_type  is  array(l..l)  of  integer  range 

type  machine l_3tate_type  is 
record 

state_number  :  natural  1; 

Sdata  :  buf fer__array_type  (other3“>d)  ; 

seq  :  integer  range  C..1  0; 

i  :  integer  range  1..1  1; 

end  record; 

type  machine2_3tate_type  is 
record 

3tate_number  :  natural  :•  1; 

Rdata  :  buffer_type  e; 
exp  :  integer  range  0..1  0; 

j  :  integer  range  1..1  :»  1; 

end  record; 

type  global_variable_type  is 
record 

DATA  :  buf fer_array_type  (other3”>e) ; 

SEQ  :  3eq_array_type  (others->-l) ; 

ACK  :  integer  range  -1..1  -1; 

end  record; 

end  definitions; 

b.  Input  of  predicate  analysis. 

The  analyze  piedicaie  functions  e  contained  in  the  predicate.action.a  file  are; 

function  Analyze_Predicate3_Machinel (local  :  machinel_3tate_type 

GLOBAL:  global_variable_type) 
return  tran3ition_stack_package . stack  is 
tempi  :  integer  :•  GLOBAL. ACK  +  0; 

begin 

MakeEmpty (tran3ition_3tack) ; 

if  ( (GLOBAL. DATA (local. i)  -  E) 

and  (GLOBAL . SEQ (local . i)  =  -1) )  then 

Push (tran3ition_3tack, 3nd_data) ; 
end  if; 

if  ((tempi  »  local. seq)  and  (GLOBAL. ACK  /=  -1))  then 
Push (tran3ition_3tack, rcv_ack0) ; 
end  if; 

return  tran3ition_3tack; 
end  Analyze_Predicate3_Machinel; 

function  Analyze_Predicate3_Machine2 (local  :  machine2_state_type 

GLOBAL:  global_variabie_type) 
return  tran3ition_3tack_package . stack  is 
begin 

MakeEmpty (tran3ition_stack) ; 
if  ( (GLOBAL.DATA (local . j) /-E) 
and  (GLOBAL . SEQ ( local . j)  =  local. exp))  then 
Push (tran3ition_3tack, rcv_data) ; 
end  if; 

if  (GLOBAL. DATA ( local. j)-E)  then 

Push (tran3ition_3tack, 3nd_ack) ; 
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end  if; 

return  transition_3tac)c; 
end  Analyze_Predicate3_Machine2; 


c.  Input  of  aftion  table. 

The  action  procedure  is  also  a  separate  compilation  unit  contained  in  the  piedicate_action.a 


fde: 


procedure  Action (in_3y3tem_3tate  :  in  out  G3tate_record_type; 

in_tran3ition  :  in  out  3cm_transition_type; 
out_3y3teni_3tate  :  in  out  G3tate_record_type)  is 

tenp  :  integer  :»  0; 

begin 

case  (in_transition)  is 
when  (3nd_data)  -> 

out_3y3tem_state .GLOBAL_VARIABLES . 

DATA (in_sy3tem_3tate. machine l_3tate . i) 

' n_3ystem_3tate .machinel_state . 

Sdata (in_sy3tem_3tate.machinel_3tate, i) ; 
out_3y3tem_3tate .GLOBAL_VARIABLES . 

SEQ (in_sy3tem_3tate .machinel_3tate . i)  : » 
in_system_3tate .machinel_state , seq; 
out_3ystem_3tate .  machine l__st ate .  i  :  - 

~  { ( (in_3ystem_stare.machinel_3tate.i)  + 

Dmod  1)  +  1; 

out_3ystem_3tate .machinel_state . seq  : * 

( ( (in_sy3tem_state.machinel_3tate . seq) 

+  1 ) mod  2 ) ; 
when  ( tcv_ack0 )  -> 

out_3y3tem_3tate.GL0BAL_VARIABLES.ACK  :•  -1; 
when  (3nd_ack)  -> 

out_3y3tem_3tate.GLOBAL_VARIABLES  .ACK  :=» 
in_3y3tem_3tate .machine2_3tate .exp; 
out_3y3tem_3tate.machine2_3tate.Rdata  :=  e; 
when  (rcv_data)  => 

out_3y3tem_3tate.machine2_state .Rdata  := 

in_3y3tem_state . GLOBAL_VARIABLES . DATA 
( in_3ystem_3tate . machine2_3tate . j ) ; 
out_3y3tem_3tate . GLOBAL_VARIABLES . DATA 

(in_3y3tem_3tate.machine2_3tate. j)  :=  E; 
out_3y3tem_state .GLOBAL_VARIABLES . SEQ 

(in_3y3tem_state .machine2_3tate . j )  :=  -1; 

out_3y3tem_3tate .machine2_state . j  : - 

( ( (in_3ystem_3tate .machine2_state . j) 

+  -Dmod  1)  +1; 

out_3y3tem_3tate . machine2_3tate . exp  : * 

( ( (in_3ystem_3tate .machine2_state .exp) 

+•  1 )  mod  2 )  ; 

.when  others  -> 

put_iine ("There  is  an  error  in  the 
Action  procedure") ; 

end  case; 
end  Action; 
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d.  Input  of  finite  state  machines. 

And,  finally,  the  input  file  for  the  finite  state  machines  is: 

start 

•  machine  1 

state  0 

trans  3nd_data  1 
state  1 

trans  rcv_ac)cO  0 
machine  2 
state  0 

trans  rcv_data  1 
state  1 

trans  snd_ack  0 
initial_state  0  0 
finish 


e.  Output  of  analysis. 

The  output  of  the  analysis  is: 


REflOMBILlTY  MM.YSIS  of  :  go.bacfc^.ul 
Global  State  OWPH 


0 

t  0  ,  0 

,  0  . 

1 

0 

1 

0 

r .  -1 

-1  ] 

snd.d*ta 

1 

1 

t  1  ,  0 

.  1  . 

1 

0 

» 

1 

0 

D  .  0 

-1  ] 

rcv.data 

2 

2 

C  1  .  1 

.  1  . 

1 

1 

1 

E  .  -1 

-1  1 

snd.ack 

3 

3 

C  1  .  0 

.  1  , 

1 

1 

0 

1 

0 

E  .  -1 

0 

1  1 

rcv.ackO 

4 

4 

1  0  .  0 

.  1  , 

1 

1 

1 

£  ,  -1 

0 

-1  1 

snd.data 

5 

5 

t  1  .  0 

,  0  . 

1 

1 

0 

1 

0  .  1 

0 

-1  1 

rcv.data 

5 

6 

t  1  .  1 

,  0  , 

1 

0 

0 

1 

0 

E  .  -1 

, 

-1  1 

3nd.ack 

7 

7 

t  1  .  0 

.  0  , 

1 

0 

0 

1 

0 

E  .  -1 

0 

0  1 

rcv.ackO 

0 

Systee  State  GRRPH 


0 

t  0  .  0 

1 

snd.data 

C  1  ,  0  1 

1 

1 

C  1  ,  0 

1 

rcv.data 

C  1  ,  1  1 

2 

2 

C  1  ,  1 

] 

snd.ack 

[1,0] 

3 

3 

t  1  ,  0 

1 

rcv.ackO 

[0,0] 

0 

Hadiine  1  (VraH  Content* 


Fron  I  To  I  Transition  I  Executed  I 


0  111  sncLdata  I  iies  I 

1101  rcv.ackO  I  ye*  i 


Machine  2  flpray  Contents  I 


Froa  I  To  I  Transition  I  Executed  I 


0111  rcv.data  I  yes  I 
1101  snd.ack  I  yes  I 
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The  output  indicates  that  no  enors  were  encountered.  The  format  for  the  variables  are  user 
dependent  and,  for  brevity  sake,  the  code  for  formatting  the  ouqjut  was  not  included. 

/.  System  state  analysis. 

System  state  analysis  is  similar  to  the  reachability  analysis  used  with  the  pure  finite  state 
m^hine  model,  but  the  total  number  of  states  which  must  be  generated  with  system  state  analysis  is 
significantly  smaller. 

The  system  state  analysis  for  a  window  size  of  1  is  shown  in  Figure  36.The  subscripts  are 
used  so  that  distinct  system  states  having  the  same  tuple  may  easily  be  distinguished.  The  convention  is  that 
the  subscript  is  initially  0,  and  is  iiKreased  whenever  a  “-A”  transition  is  taken,  by  the  number  of  messages 
which  are  being  acknowledged. 


Figure  36:  SCM,  system  state  analysis.  Go  BackN,  w=l. 

The  analysis  for  ws2  is  shown  in  Figure  37.  The  initial  states  and  variable  values  are  the 
same  as  for  the  wsl,  however  there  are  clearly  more  states  in  the  analysis. 

In  a  comparison  between  window  sizes  of  1  and  2,  it  is  noted  that  the  smaller  graph  is  a 
subgraph  of  the  larger,  either  can  be  obtained  from  the  other.  If  the  subscripts  are  taken  as  the  third  coordinate 
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in  a  3-dimensional  cartesian  coordinate  system,  with  the  states  of  each  machine  as  the  first  two  coordinates. 
The  graph  then  is  the  shape  of  a  tetrahedron,  with  edges  which  are  directed  and  labeled. 


The  graphs  contained  in  Figure  36  and  Figure  37  are  defined  with  respect  to  a  window  size 
tv.  The  graphs,  DTl(w)  for  a  nonnegative  integer  w  is  a  labeled,  directed  graph,  defined  by  the  tuple 
{N,  E,L,^) ,  where  N  =  { (;t,  >,  r)  |  (0  s  z  <  w,  r  s  jt  s  *»,  0  s  y  S  x  -  z) }  is  a  finite  set  of  nodes,  where  each 

node  is  specified  by  an  ordered  triple;  L={-D,  +D,  -A,  +Ai . 'S  a  finite  set  of  label;  the  set  E 

of  edges  is  a  set  of  ordered  pairs  ((x/,  y/,  z/),  (x/,  yj,  zj))  of  nodes  from  N,  and  is  the  union  of  the  following 
four  sets: 

»  {«x.  y.  z).  (x+1.  y,  z))l(x,y.  z)eN,  x<w) 

^2  =  {((^'  y-  y,z)€N.  y<x-z) 

Ej  =  {((x,  y,  z).  (x,  0.  y+z))l(x,  y.  z)  ^N,  (y  =  x-z).x>z) 

£4  =  {((X,  y,  z).  (x-z,  y.  0))/(x.  y.z)  eN.  z>0) 

and  the  mapping  <»(L*~E)  is  defined  as  follows: 
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V(x,y,z)  <:  £j,<6(x,y,z)  =  -D 

V(x.y,z)  €  £2.<&(x.y,z)  =  +0 

V(xy.z)  e  £3,<I>(ac,y,z)  =  -A 

V  (X,  y,  z)  6  £^,  (X,  y,  z)  =  +  ,  where  A:=x-z 

Each  node  of  the  graph  can  be  thought  of  as  a  point  in  3-diniensional  space,  with  nonnegative, 
integral  coordinates  (x,y,z).  The  structure  of  the  graph  is  a  sequence  of  w+1  triangles,  one  on  top  of  the  other, 
with  the  largest  triangle  at  the  bottom  and  the  smallest  is  a  single  point  at  the  top  level. 

One  of  the  nice  features  of  the  geometric  structure  of  this  graph  is  that  the  state  of  the  system 
can  be  easily  inferred  from  the  x,  y,  z  coordinates.  For  example,  in  Rgure  37,  point  (2,1,0),  or  system  state 
[2,1]0,  the  sender  has  transmitted  2  data  blocks  for  which  no  acknowledgment  has  yet  been  received,  the 
receiver  has  received  3  of  these,  but  acknowledged  non. 

Let  f(w)  be  the  amount  of  nodes  in  a  system  state  graph  and  g(w)  be  the  amount  of  nodes  in 
the  global  reachability  graph.  The  equations  for  g(w)  rnd  f(w),  and  the  lemmas  that  support  them,  for  the 
go_back_n  protocol  are  found  in  [LUND  91a].  For  instance,  the  graph  DTl(w)  has 

/(w)  =  1.  The  size  of  the  graphs  according  to  window  size  are: 


w 

f(w) 

g(w) 

0 

1 

1 

i 

4 

8 

2 

10 

60 

3 

20 

240 

4 

35 

700 

5 

56 

1680 

5 

84 

3528 

7 

120 

6720 

The  output  of  the  progre  for  this  protocol  was  compared  to  values  for  f(w)  and  g(w).  Test 
runs  were  done  for  window  sizes  of  0  thru  5  and  the  amount  of  nodes  in  each  graph  were  consistent  with  the 
table  above.  The  specification  input  files  and  the  output  is  in  Appendices  E  through  H. 
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2.  Selective  Repeat 

The  next  analysis  is  the  selective  repeat  protocol.The  specification  defined  in 
[BENV  9l]and  [STAL  91]  has  been  modified  as  follows.  There  are  two  machines  in  the 
system,  a  sendei^m/)  and  a  receiver  (m2)-  The  senders  (ntj)  initial  state  is  0.  Two 
assumptions  were  made  for  the  analysis.  First,  all  the  packets  transmitted  were  received 
without  error  and  second,  no  packets  were  lost  or  reordered  during  the  transmission. 

The  specification  for  the  sender  is  found  in  Figure  38.  As  the  buffer  manager 
places  data  in  the  next  available  sequence  number,  the  sender  places  the  packet  on  the 
channel  and  increments  the  index  for  the  next  packet  to  be  transmitted.  As  long  as  the  next 
packet  is  not  empty,  the  sender  will  continue  this  process  until  the  bottom  state  on  the  finite 
state  machine  is  reached,  indicating  the  transmission  of  a  full  window.  Acknowledgments 
(ACK)  are  passed  to  the  transmitter  as  they  are  received-  If  an  ACK  is  received  then  the 
transmitter  must  determine  if  the  window  may  be  opened  and  if  so,  how  far.  If  the  ACK  is 
not  for  the  first  packet  in  the  window  then  the  flag  ack_rec  is  set,  indicating  that  the  packet 
was  received  correctly.  The  window  is  not  advanced  because  packets  that  were  transmitted 
earlier  are  still  outstanding.  The  sequence  number  within  each  ACK  represents  the  actual 
sequence  number  of  the  packet  received  and  not  the  sequence  number  of  the  next  expected 
packet,  as  is  common  in  many  protocols. 

When  an  ACKs  for  the  first  packet  in  the  window  is  received  the  machine  clears 
its  buffer,  advances  the  window,  and  looks  at  the  next  sequence  number.  If  the  packet  has 
not  been  received,  then  that  becomes  the  beginning  of  the  window.  If  it  has  been  received 
then  the  next  sequence  number  is  examined  until  the  earliest  outstanding  packet  is  found  or 
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the  window  is  fully  opened.  ACKs  that  do  not  correspond  to  any  of  the  sequence  numbers 


within  the  current  window  are  ignored. 


machine  1 


out_buff : 
ack_rec : 
i : 

current ;  ( 0 ,  1 , ,  w ) 
hold:  (t,f) 


12 _ w 


( 0 , 1 , ... ,  w ) 


machine  2 


in_buff : 
pkt_rec : 

j : 

current :  ( 0 , 1  , ... ,  w ) 


12 


w 


T 


(0,1 . w ) 


Transition 

Enabling  Predicate 

Action 

-D 

out  bufferii)  /=  £  A 
hold  =/ 

DATA(i)  :=out_buffer(i} 
inc(i) 

hold  .  =  t 

+/4 

ackrecd)  =/  A 

CONTROL=A(i) 

ack  rec(i )  :=  t 

CONTROLd) .  -  E 

(0Sfc<  w) 

true 

ackj-edi)  •= / 
hold  := f 

-A 

CONTROL(j)=E  A 
pkt_rec(j)=t 

CONTROL(j)  ;=  A(j) 
pktjecij)  :-f 
injjuffd)  :=e.  inc(j) 

+D 

pktjec(j)=f 

in  bufffj)  :=  DATA(j) 

DATA(j) .  =  E 
pkt_rec(j)  :=t 

Figure  38:  SCM  specification.  Selective  Repeat,  window  size  of  l..w. 
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The  receiver  as  shown  in  Figure  38  follows  the  specification  given  in  the 
predicate  actiofi  table.  The  initial  state  of  the  receiving  machine  is  0.  Any  packets  that  are 
received  with  sequence  numbers  outside  of  the  window  are  dropped.  If  a  valid  data  packet 
is  received  then  the  +D  is  taken,  based  upon  whether  the  sequence  number  of  the  received 
packet  is  equal  to  ij.  If  the  sequence  number  is  not  then  the  flag  pkt_rsc  is  set  to  t  and  the 
packet  is  stored.  If  it  is  equal  to  then  the  pkt  rec  is  set,  the  packet  is  released  to  buffer, 
and  ijis  incremented  until  a  sequence  number  with  pkt_rec=f  is  found. 

A  sample  interaction  using  the  program  for  the  analysis  of  selective  repeat, 
w=l, consists  of  input  files  and  an  output  file.  The  variable  definitions  contained  in  the  user 


specification  file  are; 


package  definitions  is 

type  scin_transition_type  is  (snd_data,  rcv_data, 

snd_ack,  rcv_ack, 
adv_vrinl,  unused)  ; 
type  buffer_type  is  (dl,e,al  ); 
type  boolean_type  is  (t,f); 

subtype  ack__buffer_type  is  buffer_type  range  e..al; 
subtype  data_buf fer_type  is  buffer_type  range  dl..e; 

type  ack_array_type  is  array<l..l)  of  ack_buf fer_type; 
type  data_array_type  is  array(l..l)  of  data_buf fer_type; 

type  boolean_array_type  is  array(l..l)  of  boolean_type; 


type  machinel_state 
record 

state_n umber 
out_buf fer 
ack_rec 
current 
hold 

end  record; 


type  is 

;  natural 
:  data_array_type 
:  boolean_array_type 
:  integer  range  1 .  .  1 
:  boolean_type 


0; 

(dl)  ; 

=•  (others=>f)  ; 
1; 


f; 


type  machine2_state_type  is 
record 

state_number  :  natural 

in_buffer  :  data_array_type 

pkt_rec  :  boolean_array_type 

end  record; 


=  0 ; 

=  (other3=>e)  ; 
=  (others=>f ) ; 


type  global_variable_type  is 
record 

DATA  :  data_array_type  :=  (others=>e) ; 

CONTROL  :  ack_array _type  ;=  (others=>e) ; 

end  record; 


end  definitions; 
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a.  Input  of  predicate  analysis. 

The  analyze  predicate  functions  contained  in  the  predicate_action.a  file  are: 

function  Analy2e_Predicate3_Machinel {local  :  machinel_3tate_type; 

GLOBAL:  global_variable_type) 

return  tran3ition_3tack_package . 3tack  i3 
begin 

MakeEmpty (tran3ition_3tack) ; 
if  (local. out_buf f er (1)  /=  E)  then 
Push (tran3ition_3tack, 3nd_datal) ; 
end  if; 

if  ( (local. ack_rec (1) -f)  and  GLOBAL. DATA-Al)  then 
Push (tran3ition_3tack, rcv_ackl) ; 
end  if; 

Push (tran3ition_3tack, adv_winl) ; 
return  tran3itio^n_3tack; 
end  Analyze_Predicate3_Machinel; 

function  Analyze_Predicate3_Machine2 (local  :  machine2_3tate_type; 

GLOBAL:  global_variable_type)  return 

t rana it ion_3tack_package. stack  is 
begin 

MakeEmpty (transit ion_3tack) ; 

if  ( (GLOBAL. DATA  -  Dl)  and  (local .pkt_rec  ( 1) -f)  )  then 
Push (tran3ition_3tack, rcv_datal) ; 
end  if; 

if  (Ic^al  .pkt_rec  (1) -t)  then 

Push {tran3ition_stack, snd_ackl) ; 
end  if; 

return  tran3ition_3tack; 
end  Analyze_Predicate3_Machine2; 


b.  Input  of  action  table. 

The  action  procedure  is  also  a  separate  compilation  unit  contained  in  the  predicate.action.a 


file: 

procedure  Action ( in_3y3tem_3tate  :  in  out  Gstate_record_type; 

in_tran3ition  :  in  out  3cm__tran3ition_type; 
out_sy3tem_3tate  :  in  out  Gstate_record_type)  is 

temp  :  integer  :=  0; 

begin 

case  (in_tran3ition)  is 
when  (snd_datal)  => 

out_3y3tem_3tate .GLOBAL_VARIABLES .DATA  := 

in_3y3tem_3tate .machinel_state .out_buf fer (1) ; 
when  (rcv_ackl)  -> 

out_3ystem_3tate .machinel_3tate . ack_rec (1)  ;=  t; 

out_system_3tate .GLOBAL_VAKIABLES .DATA  e; 
out_3y3tem_3tate .machinel_3tate . current  :=  1; 
when  (rcv_datal)  =»> 

out  3ystem_3tate .machine2_3tate . in_buf fer ( 1)  := 

rn_3y3tem_3tate .GLOBAL_VARIABLES . DATA; 
out_3y3tem_3tate .GLOBAL_VARIABLES .DATA  :=  e; 
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out_3y3tem_3tate.machine2_3tate.pkt_rec (1) t; 
when  (3nd_ackl)  -> 

out  sy3tein_3tate  •  GLOBAIi_VARIABLES  . DATA  al; 
out~3y3tem_3tate .machine2_3tate .pkt_rec (1)  f; 

out_3y3tem_3tate .machine2_3tate . in_buf fer ( 1)  e; 

when  (adv_winl)  -> 

out_3y3tem_3tate .machinel_3tate . ack_rec 

(in_3y3tem_3tate.machinel_3tate. current)  :«  f; 
when  othera  -> 

put_line ("There  is  an  error  in  the  Action  procedure")/ 
end  case; 
end  Action; 

c.  Input  of  finite  state  machines. 

And,  finally,  the  input  file  for  the  finite  state  machines  is: 

start 
machine  1 
state  0 

trana  3nd_datal  1 
state  1 

trans  rcv_ackl  2 
state  2 

trans  adv_winl-0 
machine  2 
state  0 

trans  rcv_datal  1 
state  1 

trans  3nd_ackl  0 
initial_3tate  0  0 
finish 


d.  Output  of  analysis. 

The  output  of  the  analysis  is: 
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REACHABILITY  ANALYSIS  of  :  Ml.rop.ul 
Global  Stata  GRAPH 


0 

t  0  ,  0  ,  U  ,  F 

.  E  ,  F  . 

E  ] 

and.dstal 

1 

1 

t  1  .  0  .  U  .  F 

.  E  .  F  . 

U  ] 

rev.datal 

2 

2 

[  1  .  1  .  M.  ,  F 

,  Dl  ,  T 

,  E  1 

snd.acfcl 

3 

3 

C  1  .  0  .  nt  ,  F 

.  E  .  F  , 

A1  ] 

rov.ockl 

4 

4 

C  2  .  0  ,  m  ,  T 

.  E  .  F  . 

E  1 

adv.Mlnl 

9 

SystM  SUto  GRAPH 

0  C  0  ,  0  1 

3nd.dat«l 

t  1  . 

0  1  1 

1  C  1  ,  0  1 

rcw.datal 

t  1  . 

1  1  2 

2  t  1  ,  1  I 

snd_ocfcl 

t  1  . 

0  ]  3 

3  C  1  ,  0  1 

reu.ockl 

t  2  . 

0  1  4 

4  t  2  ,  0  1 

aikf.Hinl 

I  0  , 

0  1  0 

1  Haehine  1  frrai|  Conttnts  1 

1  Froa 

1  To  1 

1  Tromition  1 

Executed  1 

1  0 

1  1  1 

1  snd_dBtal  1 

yes  1 

1  1 

1  2  1 

1  rev.ockl  1 

yes  1 

1  2 

1  0  1 

1  4du.«lnl  1 

yes  1 

I  Hachina  2  Arraij  Contenta  I 


1  Fm  1 

1  To  1 

1  Trmition 

1  Executed  1 

1  0  1 

1  1  1 

1  rew.dMal 

1  yes  1 

1  1  1 

1  0  1 

1  snd.scfcl 

1  yes  1 

e.  System  state  analysis. 

The  system  state  analysis  for  a  window  size  of  1  is  shown  in  Figure  39 .The  subscripts  are 
used  so  that  distinct  system  states  having  the  same  tuple  may  easily  be  distinguished.  The  convention  is  that 
the  subscript  is  initially  0,  and  is  increased  whenever  a  -A  transition  is  laken,  by  the  number  of  messages 
which  are  being  acknovvledged  The  analysis  for  w=2  is  shown  in  Figure  40.  As  previously  pointed  out  initial 
states  and  variable  values  are  the  same  as  for  the  w=l,  however  there  are  clearly  more  states  in  the  analysis. 
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Figure  39:  SCM,  system  state  analysis.  Selective  Repeat,  w=l. 


Figure  40:  SCM,  system  state  analysis.  Selective  Repeat,  w=2. 

The  graphs  contained  in  Figure  39  and  Figure  40  are  the  basis  to  the  definition  of  a  window 
size  of  w.  The  graphs,  SRl(w)  for  a  nonnegative  integer  w  is  a  labeled,  directed  graph,  defined  by  the  tuple 
(iV, £,L, <t>) .  where  { (x,y,2)l  (0Sr<  w.zsjs2w,0<ysx-z) }  is  a  finite  set  of  nodes,  where 

each  node  is  specified  by  an  ordered  triple:  L={-D.  +D.  -A,  +A.  Rq . /?w./7  is  a  finite  set  of  label;  the  set  E 

of  edges  is  a  set  of  ordered  pairs  ((x/,  y/,  Z/).  (x/,  y^,  z^))  of  nodes  from  N,  and  is  the  union  of  the  following 
four  sets: 
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El  »  {((x,  y.  z).  (x+w,  y.  z))l(x.  y.z)GN,x<  w) 

^2  *  {((x- y-  *>.  (x,  1. 0))l(x.  y.  z)eN,y  +  z< x) 

Ey  ■  {((x, y.  z).  (x.  y-1,  z+I))/(x. y,z)eN,x>  z) 

£4  »  {«x.  y.  z).  (x+I.  y.  z))l(x.  y,z)eN.y  +  z<x) 

E5  ®  {«x, y,  z),  (x-(w+k), y.  z))l(x. y,z)eN,x-(y  +  z)i k) 

and  the  mapping  <t>  (L  4-  £)  is  defined  as  follows: 

^(x,y,z)  €  £,,<h(jE,y,z)  =  -D 
V(x,y.z)  e  E^<»(x,y.z)  =  +D 
V(x.y,z)  €  £y<P(Ay.z)  = -A 
yf(x,y.z)€E^,^(x,y,z)=  +A 
'^(x,y,z)  e  Ej.<l>(x,y,z)  =  E^,k  =  |w-j:| 

As  with  the  go.back.n  analysis,  each  node  of  the  graph  can  be  thought  of  as  a  point  in  3- 
dimensional  space,  with  nonnegative,  integral  coordinates  (x,y,z).  The  structure  of  the  graph  is  a  sequence  of 
w+J  triangles,  one  on  top  of  the  other,  with  the.  largest  triangle  at  the  bottom  and  the  smallest  is  a  single  point 
at  the  top  level 

Let  f(w)  be  the  amount  of  nodes  in  a  system  state  graph.  The  lemmas  that  support  it,  for  the 

2  2 

selective  repeat  protocol  are  found  in  [JENS  92].  The  graph  SRl(w)  has  /(w)  =  w  +  (w  +  1 )  .  The  size 
of  the  graphs  according  to  window  size  are: 


w 

f(w) 

0 

1 

1 

5 

2 

13 

3 

25 

4 

41 

Test  runs  were  done  for  and  the  amount  of  nodes  in  each  graph  were  consistent  with  the  table 
above.  The  specification  input  files  and  the  ouqnit  is  in  Appendices  I  and  J. 
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VI.  CONCLUSIONS  AND  RECOMMENDATIONS 


In  this  thesis,  a  program  was  introduced  that  analyzed  network  protocols  using  the 
CFSM  and  SCM  models.  The  program  was  successfully  developed  in  an  Ada  environment. 
The  Ada  tools  that  made  implementing  the  models  easier  were  encapsulation,  information 
hiding,  generic  programming  units. 

In  Ada,  network  protocol  specifications  can  be  represented  in  an  intuitive  manner.  The 
finite  state  machines  and  the  associated  predicate  action  tables  were  converted  to  Ada 
language  parameters  for  the  analysis.  The  language  environment  enforces  the  rules  of  the 
protocol  as  well  as  the  allowable  behavior  of  all  the  variables.  Dynamic  construction  of 
reachability  graphs  allowed  the  user  to  determine  how  large  or  small  an  analysis  should  be. 
The  protocol  designer  or  engineer  that  uses  this  program  can  quickly  become  familiar  with 
the  behavior  of  the  protocol  by  simply  constructing  the  Ada  specification.  It  is  interesting 
to  note  that  due  to  the  autom_ated_specification  analysis  some  previous  work  using  the  SCM 
model  has  since  been  modified.  The  analysis  provides  information  on  occurrences  of 
deadlock,  unspecified  reception,  unexecuted  transition,  and  message  flow  exceeding 
channel  capacity. 

The  programming  environment  provided  an  adequate  platform  to  develop  the 
program.  The  ability  to  use  encapsulation,  information  hiding,  tasking,  and  generic  code 
allowed  the  program  to  be  developed  in  a  step-wise,  compartmented  fashion.  The 
availability  of  a  powerful  debugger  (DBX)  enhanced  the  transition  from  developing  to 
testing  the  program.  To  allow  for  a  more  transportable  product  this  program  might  be 
convened  to  C  or  C+-t-,  so  that  others  may  benefit  from  its  use. 

The  program  was  validated  with  previous  work  done  on  widely  used  protocols.  In 
Lundy’s  papers  [LUND  88],  [LUND  91a],  [LUND  91b],  [LUND  92a]  and  [LUND  92b]  a 
num'ber  of  protocols  were  manually  analyzed  using  the  SCM  model.  A  subset  of  those 
analysis  were  performed  using  the  program,  achieving  identical  results.lt  is  interesting  to 
note  that  due  to  the  automated  analysis  of  previous  work  using  the  SCM  model,  some 
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specifications  have  had  to  be  modified.  In  must  also  be  noted  that  example  analysis  were 
only  done  on  two  machine  specifications. 

There  are  several  questions  and  areas  open  for  further  work  which  remain.  An 
important  step  would  be  to  expand  the  program  to  allow  for  more  than  two  machines. 
Although  most  protocols  can  be  modelled  with  two  machines,  it  is  a  realistic  requirement 
to  model  three  or  more.  The  program  could  be  made  more  interactive  with  the  user, 
allowing  the  user  to  change  the  specification  real  time  when  an  error  occurs.  The  program 
was  developed  for  use  on  a  workstation,  future  work  could  concentrate  on  PC  versions  of 
Ada  or  C/C++.  A  picture  is  worth  a  thousand  words;  what  is  done  textually  can  sometimes 
be  represented  better  graphically.  A  graphical  user  interface  would  enhance  the  users 
ability  to  specify  a  protocol  and  understand  the  analysis. 

It  is  important  to  say  that  developing  this  program  was  FUN.  One  of  the  features  of 
this  automated  tool  is  its  understandability.  By  developing  an  automated  tool  it  became 
apparent  that  the  user  needs  to  feel  comfortable  with  the  language  used  as  well  asTiow  a 
specification  looks  and  feels  when  input  for  analysis.  The  results  provided  by  the  many  runs 
of  this  program  focused  attention  to  where  it  needed  to  be-  the  protocol  behavior,  not  the 
programming  language  anomalies. 


83 


APPENDIX  A  CFSM  CODE 


The  program  listing  begins  on  the  following  page. 
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-data  structures  for  the  global  state  tuple (node) 
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procedure  Enqueue (Q  :  in  out  Queue; 
beqin 

it  Q.tail  =  MAX  then 
raise  QueueFull; 
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return  true; 
end  IsEqual; 
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pcocedute  Push(S  :  in  out  Stack;  E  :  In  Item)  Is 
beqin 

if  S. latest  -  MAX  then 
raise  StackFull; 
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procedure  Push(S  :  in  out  Stack; 
begin 

if  S. latest  *  MAX  then 
raise  StackFuIl; 
e  1  se 


S. latest  -  0  then 
raise  StackEmpty; 
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put (Sstate  pointer . 1 ink4 . Sys 1  ink . system  state  number,  width 


end  outputSstate  transition; 
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APPENDIX  C  (CFSM)  ALTERNATING  BIT 


INPUT  (FSM) 


5tart 

machina  1 - MACHINE  1- 

acace  1 
trans  -X  2 
acace  2 
crans  +A  3 
atace  3 
crana  -Y  4 
acace  4 
crana  +B  1 

tcachine  2 - MACHINE  2 

aCaCe  1 
crana  -rX  2 
acaca  2 
crana  -A  3 
acaca  3 
crana  +Y  4 
acaca  4 
crana  -B  1 
lnieial_acace  1  1 
finiah  ~ 
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OUTPUT 


REACHABILITY  ANALYSIS  of  :  output. alt 


Reachability 

Graph 
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Machine 

1  Array  Contents 
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1  Transition  1 
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I  Machine  2  Array  Contents  I 


1  From 

To 

1  Transition  l 

Executed  1 
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X  1 
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1  snd 
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yes  1 

1  3 

4 

1  rev 
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•  The 

nodes 

generated 

by  the 

analysis 

were  done  in  a  breadth  first  manner 
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APPENDIX  D  (CFSM)  SLIDING  WINDOW 


INPUT(FSM) 

stare 
machine  1 
state  1 
trans  -X  2 
state  2 
trans  +B  7 
trans  -Y  3 
state  3 
trans  +B  8 
trans  +C  4 
state  4 
trans  -Z  5 
state  S 
trans  -X  6 
trans  -t-A  1 
state  6 
trans  i-A  2 
trans  +B  ^ 
state  7 
trans  -y  8 
state  8 
trans  -Z  9 
state  9 
trans  *C  5 
trans  +A  1  • 
machine  2 
state  1 
trans  ♦X  2 
state  2 
trans  *'(  3 
state  3 
trans  -C  4 
state  4 
trans  *Z  5 
state  S 
trans  +X  6 
state  6 
trans  -B  7 
state  7 
trans.  ♦Y  8 
state  3 
trans  *Z  9 
state  9 
trans  -A  1 
initial_3tate  1  I 
finish 


174 


OUTPUT 


REACHABILITY  ANALYSIS  of  :  slicling_winciow 
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•  The  nodes  generated  oy  the  analysis 
were  done  in  a  breadth  first  manner 
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APPENDIX  E  (SCM)  GO_BACKJ 

INPUT  (FSM) 


scare 
machine  1 
scace  0 

crans  snd_daca  1 
acace  1  ” 

crans  rcv_ackO  0 
machine  2 
scace  0 

crans  rcv_daca  1 
sCaCe  1  ” 

crans  snd_ack  0 
inicial_scate  0  0 
finish  ~ 


,  W=1 
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VARIABLE  DEHNUIONS 


package  definitions  Is 

type  scm_transition_type  is  (snd_datal,  rcv_datal,  snd  ackl, 

rcv_aelcl,  adv_winl,  unuseS)  ; 
type  buffer_type  is  (dl.e,al); 
type  boolean_type  is  (t, f) ; 

type  buffer_array_type  is  array(l..l)  of  buffer_type; 
type  boolean_array_type  is  array (1..1)  of  boolean_type; 

type  machlnel_atate_type  is 
record  ~ 

state_number  :  natural  0; 

out_buffer  :  buf fer_array_type  (others->dl) 

aclc~rec  :  boolean_array_type  (others»>f)  ; 

current  :  integer  range  1..1  1; 

end  record; 

type  machine2_state_type  is 
record  ~ 

state  number  :  natural  0; 

in_bu7far  :  buf far_array_type  (others->e) ; 

pkt_rac  !  boolean  array_type  ;«  (others«>f) ; 

current  :  integer” range  1..1  1; 

end  record; 

type  global_variable_type  is  • 

record  ” 

DATA  :  buffer  type  :«  e; 

end  record; 

end  definitions; 
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PREDICATE-ACTION 


separate  (main) 

function  Analyze_Pre<ilcate3_Machlnol  ( local  :  machlnel_state  type; 

~  GLOBAL:  qlobal_varlabIe_type)  return  transition 

staclc_paclcaqe.staclc  Is 
begin 

MaiceEmpty  (transltion_stack)  ; 
if  (local .out_bufferTl)  /-  E)  then 
Push  (transltlon_stack,  snel_datal)  ; 
end  If; 

If  ( (local .ack_rac (1) -f)  and  GLOBAL . OATA-Al )  then 
Push (transltlon_stack, rcv_ackl) ; 
end  if;  ~ 

Push (transltlon_stack, adv_winl) ; 
return  tranaltlon_stack; 
end  Analyze_Predlcates_Machlnel; 

separate  (main) 

function  Analyze_Prodlcates_Machlne2  ( local  :  inachine2_state  type; 

~  GLOBAL:  global_varla)3le_type)  return  transition 

stack_Fackage . stack  Is  ~ 

)9egln 

MakeEmpty (transition  stack); 

if  ( (GLOBAL. DATA  -  dT)  and  ( local .pkt_ree ( 1) -f) )  then 
Push (transition_stack,  rcv_datai) ; 
end  if;  ~  ~ 

if  (local. pkt  rec(l)-t)  then 

Push (transTtlon_stack, snd^ackl) ; 
end  if;  ~  ~ 

return  transltion_scack; 
end  Analyze_Predicates_Machine2; 

separate  (main) 

procedure  Action (in_system_stat4  :  in  out  Gstate_record_type; 

~in_transit ion  :  in  out  scm~transit ion_type; 
out_system_state  :  in  out  Gstate_record_type)  is 

temp  :  integer  :•  0; 

begin 

case  (in_transition)  is 
when“(snd_datal)  •> 

out_system_stace . GLO0AL_VAR TABLES .DATA  : • 

~in_system_stace  .mach”inel_stace  .out_buf  fer  ( 1 )  ; 
when  (rc\r_ackl)  ~->  ~ 

out_3ystem_state .machinel_state . ack_rec ( 1)  :•  t; 

our_system_state .GLOBAL_VARIABLES .DATA  e; 

ouc_system_state .machinel_state .current  1; 

when  (rcv_datal)  •> 

out_syscem_3tate . machine2_scace . in_buf  fer ( 1 ) 
in_system_state.GLOBAL_VARIABLEsTOATA; 
out_system_state.GLOBAL_VAB TABLES. DATA  :•  e; 
out_3ystem_stace .machine2_stace .pkt_rec ( 1) :•  t; 
when  (snd_ackl)  -> 

out_system_state .GLOBAL_VARTABLES .DATA  al; 
out_systom~state .machine2  state .pkt_rec ( 1)  f; 
out’_system_state .machine?_state .  in_buf  fer  ( 1)  :«  e; 

when  (adv_wlnl)  -> 

out_system_3tate . ma- 

ohinel_state  .  ack_rec  (  in_systein_state  .:^achine  Istate  .current )  f; 
when  others  -> 

put_l ine ("There  is  an  error  in  the  Action  proceoure") ; 
end  case; 
end  Action; 
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OUTPUT  FORMAT 


separate  (main) 

procedure  output_Gtuple (tuple  :  In  out  Gstate_record_type)  Is 
)>egln  ~ 

put  (*  [*  t  Integer' Image  (tuple. machinel_scace. state_nuniber)  >  ; 

put (•  k  integer' image (tuple .machine2_state .3Cate_number) ) ; 
putC  ,  •); 

put (tuple. machinel_state .out_buffer (1) ,  width  •>  1); 
put ('  ,  *)  ; 

put (tuple. machinel_state.ack_rec(l) ,width->2) ; 
put('‘  ,•); 

put (tuple. machine2_state. in_buf£er (1) ,  width  •>  1); 
put (*  ,  •) ; 

put (tuple. machlne2  state. pkt  rec ( 1) , width»>2) ; 
put(-  .'); 

put  (tuple.  GLOBAL  VARIABLES.  OAT  A,  width  »2); 
putC  ]'); 
end  output_Gtupie; 


separate  (main) 

procedure  output_Gtuple_co_file (tuple  :  in  out  Gstate_record_type; 

counter  :  in  out  integer)  is 

begin 

put (reach, counter) ; 

put(reach,'’  ['  (  integer' image  (tuple  .machinel_state .  state_number)  )  ; 
put(reach,'’  ,  '  c  integer' image  (tuple  .machine2_state.scate_number)  )  ; 
put  (reach,"  ,  *); 

put (reach, tuple. machinel_state. out  buffer(l),  width  ->  1); 
put (reach,"  ,  *) ; 

put  (roach,  tuple. machinel_state.acic_rec(l)  ,width«>2)  ; 
put (reach, "  ,"); 

put (reach, tuple. machine2  state. in  ouffer(l),  width  ->  1);  — 

put  (reach,*  ,  ’*); 

put  (reach,  tuple.fflachine2_state.pl(t  rec  (1) ,  widtha>2)  ; 
put (reach,"  ,  *)  ; 

put (reach, tuple. GLOBAL  VARIABLES . DATA,  width  «>2) ; 
put (reach,"  ]*); 
new_line (reach) ; 
end  output_Gtuplo_to_£ile; 


separate  (main) 

procedure  oucput_Gstate_node (Gstate  pointer  ;  in  out  Glink_type; 

Error_flag  :  in  out  boolean)  is 

begin  ~ 

output_line_count  :•  output  line_count  *  1; 
if  ( (output~line_count  mod  TO)  ■  0)  then 
scroll_pause; 
and  if; 

set_col (Gcolumn_set )  ; 

putTGstate_pointer  .  3y3tem_state_number,  width  =■>  3)  ; 
autput_Gtuple (Gstate  pointer .Gtuple) ; 

if  (  (Gstate_pointet .  Tinjil  .Glink  »  null)  and  then  (Gstate_pointer  .  Iink2  .Glink  »  null) 
and  then  ~  ~ 

(GstaCe_pointer.  iink3  .Glink  -  null)  and  t.ien  (Gstate_pointer.  Iink4  .Glink  »  null)) 

then 

Error_flag  :•  true; 

else 

Error_flag  false; 
end  if; 

end  output_Gstate_node; 
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APPENDIX  F  (SCM)  GO  BACK^N,  W=2 


INPUT  (FSM) 


sCart 
machine  1 
sCaCe  0 

trans  sn<l_claca  1 
scate  1 

Crana  sn<l_daca  2 
Ccans  rcv_aclcO  0 
scate  2  ~ 

Crans  ccv_ackO  0 
Ccans  ccv_ackl  1 
machine  2 
sCaCe  0 

trans  rcv_data  1 
state  1  ~ 

Crans  rcv_data  2 
trans  snd_ack  0 
state  2  ~ 

trans  and_ack  0 
initial_state  0  0 
finish  “ 
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VARIABLE  DEFINITIONS 


package  definitions  Is 


type  scin_transition  type  is  (snd_data,  rcv_data, 

~  sn5_ack,  rcv_ackO, 

rcv_ackl,  unused) ; 

type  buffer_type  is  (dO, dl, e, a) ; 

type  buf fer_array_type  is  array(1..2)  of  buffer_type; 
type  seg_array_type  is  array (1.. 2)  of  integer  range  -1..2 

type  i«achincl_state_type  is 
record 

state_number  :  natural  :■  0; 

Sdata  :  buffer_array_typo  (dO,dl); 

seq  :  integer  range  0..2  0; 

1  :  Integer  range  1..2  :«  1; 

end  record; 

type  tBachine2_st*te_type  is 
record  ~ 

state_number  :  natural  :■  0; 

Rdata  :  buffer_type 

exp  :  integer  range  0..2  0; 

j  :  Integer  range  1..2  :«  1; 

end  record; 

type  global_variable_type  is 
record 

data  :  buf fer_arraY_type  :•  (e,e); 

SEQ  !  aeq_acray_type  (-1,-1); 

ACK  :  integer  range  -1..2  -1; 

end  record; 


end  definitions; 


PREDICATE-ACTION 


separatee  (main) 

funct-ion  Analyze_Preclicates_Machinel  ( local  :  machinel_sCate  type; 

GLOBAL:  qlobal_variabre_type)  return  transition_- 
3tac)i_paclcage .  stacli  is  ~ 

tempi  :  integer  GLOBAL. ACK  +  0; 
temp2  :  integer  (GLOBAL. ACK  +  Dmod  3; 

begin 

MalceEmpty  (transition  stack)  ; 

if  ( (GLOBAL. DATA (local. i)  -  E)  and  (GLOBAL. SEQ( local.!)  -  -1))  then 
Push (transition_stack, 3nd_data) ; 
end  if;  ~ 

if  ((tempi  -  local. seg)  and  (GLOBAL. ACK  /-  -1))  then 
Push (transition_stack,  rcv_ack0) ; 
end  if; 

if  ( (temp2  -  local. seg)  and  (GLOBAL. ACK  /«  -1))  then 
Push (transition_stack, rcv_ackl) ; 
end  if; 

return  transition_stack; 
end  Analyze_Predicate3_Machinel; 


separate  (main) 

function  Analyze_Predicates_Machine2 ( local  :  machine2_state_type; 

GLOBAL:  global_variable_type)  return  transition_- 
stack_package . stack  is  ~ 

begin 

MakeEmpty (transit ion_stack) ; 

if  ( (GLOBAL. DATA( local . j) /=E)  and  (GLOBAL .SEQ ( local . j )  -  local. exp))  then 
Push (transition  stack, rev  data) ; 
end  if;  ~  ~ 

if  (GLOBAL. DATAdocal.  j) -E)  then 
Push (transit ion_stack,  snd_ack)  ; 
end  if;  ~ 

return  tran3ition_stack; 
end  Analyze_Predicate3_Machine2; 

separate  (main) 

procedure  Act  ion ( in_system_state  :  in  out  Gstate_record_type; 

'’in_transition  :  in  out  scm'transit ion_type; 
out_3ystam_state  :  in  out  Gstate_record_cype)  is 

temp  :  integer  0; 

begin 

case  ( in_t ransit ion)  is 
when~(snd_data)  •> 

out_system_state . GLOB AL_VAB  TABLES . DATA ( in_system_st ate . machine l_state . i )  :  = 
in_sy3tem_state .machinel_state .Sdata ( in_sy stem_st ate .machine l_st ate . i) ; 
out_system_state .GLOBAL_VAR  TABLES . SEQ ( in_system_state .machinel_state . i)  :  = 
in_sy3tem_state .machinel_state. seg; 
if  ( in_system_state .machinel_state . i  -  1)  then 
ouT  system  state . mach ;ne  1  state.:  :=  2; 

•  else 

out_system_state . mach inel_state . 1  1; 

end  if; 

out_system_st ate . macn i ne l_st a te . seg  : =  ( ( ( in_system_state . machine l_state.- 
seg)  *  Dmod  3); 

when  (rcv_ack0)  -> 

out_system_state .GLOBAL_VARIABLES . ACK  -1; 
when  (rcv_ackl)  =•> 

out_3y3tem_3tate  .GLOBAL_VARIABLES  .  ACK  :  =■  -1; 
when  (snd_ack)  => 

out_system_scate.  GLCiBAL_VAR  TABLES  .ACK  :«  in_system_stace.machine2_state.- 

exp; 

out_3ystem_state  .machine2_state -Rdata  :=■  e; 
when  (rcv_data)  => 

out_system_stace  . mach ine2_sr,ate  -Rdata  ;=  in_system_state  . GLOBAL_VART - 
ABLES . DATA ( in_system_state .machine2  state. j); 

out_system  state. GLOBAL  VARIABLES .DATA ( in  system  state .machine2  state. j)  := 

E ;  _  _  _ 

out_syscem  state. GLOBAL  VAR  I ABLES . SEQ  (in  system  state .machine2  state.])  :  = 

- 1 ;  _  _  _ 

if  ( in_system_state . machin92  state.]  =  1)  then 
out_3ystem_3tate .machinej_state.  i  2; 
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else 

out_system_state .machine2_state. j  :»  1; 
end  if; 

ouc_system_state.machine2_state.exp 

( ( (injsystem_3tate.machine2_scate.exp)  +  Dmod  3) 
when  others  «> 

put_line ('There  is  an  error  in  the  Action  procedure*) 
end  case;  ~ 
end  Action; 


OUTPUT  FORMAT 


separate  (main) 

procedure  output_Gtuple (tuple  :  in  out  Gstatfc_record_type)  is 
begin  ~ 

put  C*  {*  t  integer' image  (tuple  ..■nachinel_state .  state_number)  i  “ 
put (integer' image (tuple .machine2  state . atate_number) ) 7 
put(-  ,*); 

put (tuple. machinel_state.seq,  width  «>  1) ; 
put(*  ,  *); 

put (tuple .machinel_state. i,  width  >>  1); 
put  (*  ,  *)  ; 

put (tuple. machine2_state. exp,  width  ->  1); 
put(*  ,  *); 

put (tuple .machine2_state. j,  width  ->  1); 
put (•  ,  •) ; 

put (tuple.GLOBAL  VARIABLES. DATA (1) ,  width  ->3) ; 
put (tuple. GLOBAL~VARIABLES.SEQ(l) ,width->2) ; 
putC* 

put (tuple. GLOBAL_VARIABLES. DATA(2)  ,  width  ->3) ; 
put (tuple.GLOBAL_VARIABLES.SEQ (2 ) ,width->2) ; 
putC 

put (tuple. GLOBAL_VARIABLES.ACK,  width  ->  3) ; 
put(-  ]'); 
end  output_Gtuple; 


separate  (main) 

procedure  output_Gtuple_to_file (tuple  :  in  out  Gstate_record_type; 

counter  :  in  out  integer)  is 

begin 

put (reach, counter) ; 

put(reach,'  (*  t  integer' image  (tuple  .machinel_state .  state_number)  &  * 

'  putTreach,  integer'  image  (tuple.. machine2_state .  state_number) )  7 
put (reach,"  ,  ") ;  ~  ~ 

put (reach, tuple .machinel_state . seq,  width  •>  1) ; 
put (reach,"  ,  *) ; 

put (reach, tuple .machinel_stace . i,  width  •>  1)  ; 
put  (reach,"  ,*); 

put (reach, tuple .machine2_state .exp,  width  ->  1); 
put (reach,"  ,  *)  ; 

put (reach, tuple .machine2_state  .  j,  width  •>  1); 
put (reach, "  ,  *) ;  ~ 

put  (rer.ch,  tuple. GLOBAL_VARIABLES.  DATA  (1)  ,  width  *>3); 
put (reach, tuple .GLOBAL_VARIABLES .SEQ ( 1) , width->2> ; 
put  (roach,"  ,  ")  ;  ~ 

put (roach, tuple. GLOBAL_VARIABLES. DATA(2) ,  width  ->3) ; 
put (reach, tuple .GLOBAL_VARIABLES . SEQ (2)  ,  width»>2)  ; 
put  ( reach,  "  ,"); 

put (reach, tuple. GLOBAL_VARIABLES.ACK,  width  ->  3) ; 
put (reach, "  ] ") ; 
now_l ine ( reach ) ; 
end  output_Gtuple_to_f i le; 

separate  (main) 

procedure  output_Gstate_node (G3tace_po inter  :  in  out  Glink_type; 

Error_fiag  :  in  out  boolean)  is 

begin 

output_line_count  :•  output_line_count  *•  1;  ■ 
if  ( (output_l ine_count  mod  10)  =  0)  then 
scroll_pause;~ 
end  if;  ~ 

set_col (Gcolumn_set) ; 

put (Gstate_pointer . 3y3tem_3tate_numDer,  width  =>  3) ; 
output_Gtuple (Gstate_pointer .Gtuple) ; 

if  (  (Gstate_pointer  .  linkl  .G1  ink  =■  null)  and  then  (Gst ate_pointer  .  1  ink2  . G1  ink  “  null) 
and  then 

(Gstate_pointer . 1 ink3  .G1  ink  =  null)  and  then  (Gstate_po inter . 1 ink4 .G1 ink  =  null)) 

then 

Error_flaq  :•  true; 
else 

Error_flag  :=•  false; 
end  if; 

end  output_Gstate_node; 
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OUTPUT 
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APPENDIX  G  (SCM)  GO_BACK_N,  W=3 


INPUT  (FSM) 

sCart 
machine  1 
scace  0 

Crana  3nd_data  1 
atace  1 

tcana  ccv_ac)cO  0 
Crana  and_daCa  2 
acace  2 

crana  rcv_ackO  0 
crana  rcv~ackl  1 
Crana  and_daCa  3 
acaCe  3 

Crana  ccv_ackO  0 
Crana  rcv_ackl  1 
crana  rcv2ack2  2 
machine  2 
acace  0 

Crana  rcv_daCa  1 
acace  1 

crana  rcv_daca  2 
Crana  snd_ack  0 
scace  2 

crana  rcv_daca  3 
crana  and_ack  0 
aCaCe  3 

crana  and_ack  0 
Iniclal  aCaCe  0  0 
f iniah 
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VARIABLE  DEFINITIONS 


package  definitions  is 


type  scm_transition_type  is  (snd_data,  rcv_data, 

snd_aclc,  rcv_aclcO, 
rcv_aclcl,  rcv_ack2,  unused)  ; 

type  buffer_type  is  (dO, dl, d2, e, a) ; 

type  buffeE~«rray_type  is  array (1.. 3)  of  buffer_type; 

type  seg_array_type  is  array(1..3)  of  integer  range  -1..3; 

type  inachinel_state_type  is 
record  ~  ~ 

state_nuinber  :  natural  :«  0; 

Sdata  :  buf fer_array_type  :»  (d0,dl,d2); 

seq  :  integer  range  0..3  :•  0; 

i  :  integer  range  1..3  1; 

end  record; 

type  inachine2_state_type  is 
record 

state_nunvber  :  natural  0; 

Rdata  :  buffer_type  :•  e; 

exp  :  integer  range  0..3  0; 

j  :  integer  range  1..3  :»  1; 

end  record; 

type  global_variable_type  is 
record  ~  ~ 

DATA  ;  buf fer_array_type  :•  (e,e,e); 

SEQ  :  seq_arEay_type  :»  (-1,-1,-1) 

ACK  ;  integer  range  -1..3  :»  -1; 

end  record;  • 

end  definitions; 
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PREDICATE-ACTION 


separate  (main) 

function  Analyze_Pre<licate3_Machinel  (local  :  machinel_state  type; 

~  GLOBAL:  global_variabre_type)  return  transition_- 

staclc_package. stack  Is 

tempi  :  integer  :•  GLOBAL. ACK  +  0; 
temp2  :  Integer  :•  (GLOBAL. ACK  Dmod  4; 

temp3  :  integer  (GLOBAL. ACK  -  2)mod  4; 

begin 

MakeEmpty (transit ian_stack) ; 

if  ( (GLOBAL. DATA (local.!)  -  E)  and  (GLOBAL.SEQ( local . i)  •  -1) )  then 
Push (transition_stack, snd_data) ; 
end  if;  ~ 

if  ((tempi  •  local. seg)  and  (GLOBAL. ACK  /-  -1))  then 
Push (transition  stack, rcv_ackO> ; 
and  if;  ~ 

if  ((temp2  -  local. seg)  and  (GLOBAL. ACK  /•  -1))  then 
Push (transition_stack, rcv_ackl) ; 
end  if;  ~ 

if  ( (temp3  •  local. seg)  and  (GLOBAL. ACK  /»  -1))  then 
Push (transltlon_stack, rcv_ack2) ; 
end  if; 

return  transitlon_stack; 
end  Aralyza_Predicates_Machinel; 


separate  (main) 

function  Analyze_Predicates_Machlne2 ( local  :  machine2_stace  type; 

~  ”  GLOBAL:  global_3variable_Cype)  return  transition 

stack_package . stack  is  -  - 

begin 

MakeEmpty (transition  stack); 

if  ( (GLOBAL. DATA (local. j I /-E)  and  (GLOBAL.SEQ (local . j)  -  local. exp))  then 
Push (transition  stack, rcv_data) ; 
end  if;  ~  ~ 

if  (GLOBAL. DATA ( local. 3) -E)  then 
Push (transitlon_stack, snd_ack) ; 
end  if; 

return  transition_stack; 

end  Analyze_Predicates_Machine2;  —  this  returned  value  is  then  checked  against  the 
machine  arrays  ~ 

--  to  determine  if  indeed  this  transition  can  be 

taken 


separate  (main) 

procedure  Action ( in_system_state  :  in  out  Gstate_record_type; 

in_transition  :  in  out  scm_transition_type; 

out_system_3tate  :  in  out  Gstate_record_type)  is 

temp  :  integer  :■  0; 

begin 

case  (in_transition)  is 
when  (snd_data)  -> 

out_system_state .GLOBAL  VARIABLES .DATA ( in_system_state . machinel_state . i )  : • 
~  in_system_state  .macTi  inel_state  .Sdata  ( in  system_state  .machinel_state  .i); 
out_system_state  .GLOBAL_VARIABLES  .SEQ  (  in_sy'5tem_state  .machinel_state  .  i )  :» 

in_system_state .machinel_state. seg; 
begin 

case  (in  system_3tate .machinel  state.:)  is 
when  T  »> 

out_system_state .mdchinel_state . i  2; 
when  2~“> 

out_system_3tate .machinel_state . i  : •  3; 
when  3~»> 

out_system_state .machinel  state.!  1; 
when  others  ~ 

null; 
end  case; 
end; 

out_system_state .machinelstate. seg  :•  (((in_system_state .machinel_state . - 
seg)  ♦  Dmod  4); 

when  (rcv_ack0)  *> 

out_system_state.GLOBAL_VAR TABLES. ACK  '1; 
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wh«n  (rcv_ackl)  -> 

out_systom_state.GLOBAL_VARIABLES.ACK  -1; 

when  (rcv_ac)c2)  »> 

out_aystem_state.GLOBAL_VARIABLES.ACK  :»  -1; 
when  (snd_ack)  -> 

out_systom_state .GLOBAL_VARIABLES .ACK  in_system_state .machine2_3tate 

exp; 


out_system_3tate.machine2_state.Rdata  e; 
when  (rcv_datar  •>  ~ 

out_systom_state .machine2_state.Rdata  :«  in_systom_state.GLOBAL_VARI- 
ABLES. DATA (ln_sy^tem_st ate .machlne2_state. j) ; 

out  system  state.GLOBAL~VARIABt.ES .DATA( ln_system_state .machine2_state . j) 
B; 


-1; 


out_system_3tate.GL0BAL_VARIAaLES.SEQ  {in_system_state.machine2_state. j) 


begin 

case  (In  system_state .machine2_3tate . j )  Is 
when  T  «>  ~ 

out_system_state .machine2_3tate . j  2; 

when  2~»> 

out_system_state .machine2_3tate . j  3; 

when  3  •> 

out_system_state .machlne2_state . j  1; 

when  others 
null; 
and  case; 
end; 

out_system_state .machine2_state .exp  ( ( ( in_system_state .machine2_state . 
exp)  +  Drnod  4); 

when  others  >> 

put_line (•There  Is  an  error  in  the  Action  procedure*); 
end  case;  ~ 
end  Action; 
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OUTPUT  FORMAT 


separate  (main) 

procedure  oucput_Stuple (tuple  :  In  out  Gstate_record_type)  Is 
begin  ~ 

put(*  (*  i  Integer* Image (tuple .machinel_state . state_number)  C  *  ,*); 
put (Integer* Image (tuple .machine2_s cate . state_number) ) 7 
put (•  ,  *)  ; 

put (tuple .machlnel  state. seq,  width  ->  1); 
putC  .  •); 

put (tuple. machlnel  state. 1,  width  ■>  1); 
put(-  .  •); 

put (tuple. machlne2_stace. exp,  width  ->  1); 
putC*  ,  *); 

put (tuple .machlne2  state. j.  width  ->  1); 
putC*  .  •); 

put (tuple. GLOBAL_VARIABL£S. OATA(l) ,  width  •>3); 
put (tuple. GLOBAL_VARIABLES.SEQ(l) , width->2) ; 
put (*  .*); 

put (tuple. GLOBAL_VARIABLES. DATA(2) ,  width  ->3) ; 
put (tuple. GLOBAL  VARIABLES .SEQ (2) , width->2) ; 
putC  . 

put (tuple. GLOBAL  VARIABLES . DATA (3) ,  width  •>3); 
put (tuple.GLOBAL~VARIABLES.SEQ(3) , widCh->2) ; 
putC  ,'); 

put (tuple. GLOBAL  VARIABLES . ACK,  width  •>  3) ; 
putC  ]**); 
end  output_Gtuple; 

separate  (main) 

procedure  output_Gtuple_to_file (tuple  :  in  out  GstaCe_record_type; 

~  -  -  counter  :  in  out  Integer)  is~ 

begin 

put (reach, counter) ;  —  - 

put (reach,*  (*  (  integer* image (tuple. machinel_stace.3tate_number)  t  *  ,’); 

put (reach, integer* image (tuple .machine2_scate . stace_number) ) 7 

put (reach,*  ,  *) ;  ~ 

put  (reach,  tuple .machinel_state .  seq,  width  ’>>  1); 

put (reach,*  ,'); 

put (teach, tuple. machinel_state . i,  width  •>  1); 
put (reach,*  ,  •);  ~ 

put (reach, tuple. machine2_state. exp,  width  •>  1) ; 
put (reach,*  ,  *); 

put (reach, tuple .machine2_state . j,  width  >>  1); 
put( reach,”  ,  *)  ; 

put  (reach,  tuple. GLOBAL_VARIA8LES.OATA  (1)  ,  width  =>>3); 
put (reach, tuple .GLOBAL_VAR TABLES . SEQ ( 1) , width->2) ; 
put  (reach,*  ,  '); 

put (reach, tuple. GLOBAL  VAR  I ABLES . DATA (2 ) ,  width  ->3) ; 
put (reach, tuple .GLOBAL'VAR lABLES . SEQ (2)  ,  width- >2)  ; 
put (reach,*  ,*); 

put (reach, tuple .GLOBAL_VARIABL£S . DATA (3) ,  width  ->3) ; 
put (reach, tuple .GLOBAL_VARIABLES . SEQ (3) , width->2) ; 
put (reach, *  , *) ; 

put (reach,  tuple. GLOBAL_VARIABLES. ACK,  width  ->  3); 
put (reach, *  1 *) ; 
new_line (reach) ; 
and  output_Gtuple_to_f i le; 

separate  (main) 

procedure  output_Gstate_node (Gstate  pointer  :  in  out  Glink  type; 

Error_riaq  :  in  out  boolean)  is 

begin 

output_line_count  output  line_count  *  1; 
if  ( (output_l ine_count  mod  TO)  -  0)  then 
scroll_pause;~ 
end  if;  ~ 

set_col (Gcolumn_set ) ; 

put (Gstate_polnter . systemstatenumoer,  width  ->  3); 
output_Gtuple (Gstate  pointer.Gtupie); 

if  ( (Gstate_pointer .  Finxl .G1  ink  -  null)  and  then  (Gstate_pointer . 1 ink2 .Glink  =  null) 
and  then 

(Gstate_pointer . 1 ink3 .Gi ink  -  null)  and  then  (Gscate_pointer . Iink4 .Glink  -  null)) 

then 
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Error  flag  true; 

else 

Error_flag  false 

end  If; 

end  output_GstaCe_node; 


OUTPUT 
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VARIABLE  DEFINITIONS 


p«ckag«  definitions  Is 


type  scm_transltlon_type  Is  (snd_data,  rcv_data, 

“  snd_ac)t,  rcv_acltO, 

rcv_acltl,  rcv_ack2, 
tcv_ack3,  unused); 

type  buffor_type  Is  (dO, dl, d2, d3, e, a) ; 

type  buffer_array_type  Is  array (1.. 4)  of  buf fer_type; 

type  seq_array_type  Is  array(1..4)  of  integer  range 

type  niachinel_state_type  is 
record  ~ 

state  number  :  natural  :•  0; 

Sdata~  :  buf fer_array_type  (dO, dl. d2, d3) ; 

seq  :  Integer  range  0..4  0; 

1  :  integer  range  1..4  1; 

end  record; 

type  machine2_state_type  is 
record 

state  number  :  natural  :•  0; 

Rdata~  :  buffer_type  e; 

exp  :  integer  range  0..4  !”  0; 

j  :  integer  range  1..4  :■  1; 

end  record; 

type  global_variable_type  is 
record  ” 

DATA  :  buf fer_array_type  :•  (e,e,e,e); 

SEQ  :  seq_array_type  :«  (-1, -1, -1, -1) ; 

ACK  :  integer  range  -1..4  :»  -1; 

end  record; 

end  definitions: 
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PREDICATE-ACTION 


separata  (main) 

function  Analyze_Predlcates_Machlnel  (local  :  niachlnel_state  type; 

SLOBAL:  global_varlabIe_type)  return  transition_- 

staclc_package. stack  is 

tempi  :  Integer  GLOBAL. ACK  +  0; 

tempi  :  integer  :•  (GLOBAL. ACK  +  Dmod  S; 

temp3  :  integer  (GLOBAL. ACK  +  2) mod  5; 

temp4  :  integer  (GLOBAL. ACK  *  3) mod  S; 

begin 

MakeEmpty (transition  stack); 

if  ( (GLOBAL. DATA (local.!)  -  E)  and  (GLOBAL.SEQ (local . i)  >  -1))  then 
Push (transition  stack,  snd  data); 
end  if;  ~ 


if 

((tempi  >  local. seq)  and  (GLOBAL. ACK 
Push (transition  stack, rev  ackO); 

/-  -D) 

then 

end 

if; 

if 

( (temp2  -  local. seq)  and  (GLOBAL. ACK 
Push (transition  stack, rev  ackl) ; 

/-  -D) 

then 

end 

•if; 

if 

{(tempi  »  local. seq)  and  (GLOBAL. ACK 
Push (transition  stack, rev  ack2) ; 

/-  -D) 

then 

end 

if; 

if 

( (temp4  <•  local,  seq)  and  (GLOBAL.  ACK 

/-  -D) 

then 

Push (transition  stack, rev  ack3) ; 
end  if;  ~ 

return  transition_stack; 
end  Analy2e_Predicates_Ma':hinel; 


separate  (main) 

function  Analyze_Pradicates_Machlne2 ( local  :  machine2_state_type; 

~  ~  GLOBAL:  global_va'r iable” type)  return  transition_- 

stack_package, stack  is  -  -  —  .  - 

begin 

MakeEmpty (transition  stack); 

if  ((GLOBAL. OATA(local.j)/-E)  and  (GLOBAL.SEQ ( local . j)  >  local. exp))  then 
Push (transition_stack, rcv_data) ; 
end  if;  ~ 

if  (GLOBAL. DATAdocal.  j) -E)  then 
Push (transit ion_stack, snd_ack) ; 
end  if; 

return  transition_atack; 
end  Analyze_Predlcate3_Machine2; 

separate  (main) 

procedure  Act  ion ( in_3ystem_state  :  in  out  Gstate_record_type; 

in_transit ion :  in  out  scm_transition~type; 
out_3y3tem_state  ;  in  out”Gstate_record_type)  is 

temp  :  integer  0; 

begin 

case  (in_transition)  is 
when  (snd_data)  ■> 

out_system_3tate‘. GLOBAL  VARIABLES  .DATA (  in  system_3tate  .machinel_state  .  i)  :  = 
~  in_3y3'tem_state  .macTiinel_state  .Sdata  ('In_system_state  .machinel_state  .  i)  ; 
out_system_stato .GLOBAL_VARIABLES .SEQ ( in_sy stem_st ate .machine l_state . i)  : * 
in_3y3tem_3tate .machinel_state . seq;  ^ 
begin” 

case  (in  3ystem_3tate .machinel  state.!)  is 
when  I  ->  ” 

out_system_state .machinel_state . i  2; 

when  2  -> 

out_system_state . machinel_state . i  3; 

when  3  -> 

out_sy3tem_state  .niachinel_state .  i  4; 

when  4”»> 

out_sy3tem_state .machinel_3tate . i  :•  1; 
when  others  «> 
null; 
end  case; 
end; 

out_system_state.machinel_3tate.seq  :» 

(”(  (ln_sy3tem_state.machinel_3tate.seq)  +  Dmod  5)  ; 
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wh«n  (rcv_aclcO)  -> 

out_system  state. GLOBAL_VARrAflLES.ACK  :«  -1; 
when  (rcv_acltir  «> 

ouC_system_state.GLOBAL_VARIABLES.ACX  :■  -1; 
when  (rcv_aclc2)  ■> 

out_sysCem_staCe.GLOBAL_VARIABLES.ACK  -1; 

when  (rcv_ack3)  «> 

OUC_system_state .GLOBAL_VARIABL£S . ACK  :«  -1; 
when  (sncl_aek)  •>  ~ 

out_sy3tem_sCate .GLOBAL_VARIABLES .ACK  in_system_3tace .machine2_state . 

exp; 

0uC_sysCem_sCace.machine2_scaCe.RdaCa  e; 

when  (rcv_data)  ->  ~ 

out  syacem_state.machlne2_stace.Rdata  :• 

~ln  system_staCe.GLOaAL_VARIABLES. 

DAfA(ln_syscem_state.machine2_stace. j) ; 
out  system  state. GLOBAL  VARIABLES'^  DATA  (in  system  state  .machlne2  state,  j) 
~E;  ~  ~  ~ 

out  system  state. GLOaAL_VARIABLES.S£Q  (in  system  state .machine2  state. j) 

~  -1;  ~ 
begin 

case  (in  system  state .machine2  state. j)  is 
when  I  ->  “ 

out_system_stace.machine2_scace. j  ;»  2; 
when  2  ->  ~ 

out_3ystem_scace .machine2_state . j  :«  3; 
when  3  •> 

out_3ystem_state .machine2_state . j  4; 

when  4~«>  ~  ~ 

out_sysCem_state .machine2_scate . j  :«  1; 
when  o'thers  •> 
null; 
end  case; 
end; 

out_aystem_state.machine2_staca.exp  :■  ( ( (in_system_state.machine2_state. 

“exp)  ♦~l)mod  S);  ~  - -  ~ 

when  others  ■> 

put_line ("There  is  an  error  in  the  Action  procedure'); 
end  case;  ~ 
end  Action; 
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OUTPUT  FORMAT 


saparat*  (main) 

procadura  ouCpuC_GCupla (Cupla  :  in  ouc  GsCaca_racord_Cypa)  ia 
bagln  ~ 

putC*  [*  t  integar' image  (tuple  .machinel_state.  state_number)  t  " 
put (integer' image (tuple. machine2_st ate . state  number) ) ; 
putC  .  •); 

put (tuple. machinel_atate.seq,  width  »>  1); 
put  ("  ,  ')  ; 

put (tuple. machinel_stata . i,  width  ->  1); 
putC  ,  •); 

put (tuple. machine2  state. exp,  width  •>  1); 
putC  ,  •); 

put (tuple. machineZ  state. j,  width  >>  1); 
putC  ,'•); 

put (tuple. GLOBAL_VARIABLES. DATA(l) ,  width  ->3) ; 
put ( tuple. GLOBAL_VARIABLES.SEQ(l) ,width->2) ; 
put (*  ,  *) ; 

put  (tuple. GLOBAL_VARIABl.ES. DATA(2)  ,  width  ->3); 
put (tuple.GL0BAL_VARIABLES.SEQ(2) ,wldth->2) ; 
putC  ,  •); 

put (tuple. GLOBAL_VARIABLES. 0ATA(3) ,  width  ->3); 
put (tuple. GLOBAL_VARIABLES. SEQ(3) ,width->2) ; 
put (*  , *) ; 

put (tuple. GLOBAL  VARIABLES.0ATA(4) ,  width  ->3) ; 
put (tuple.GLOBAL~VARXABLES.SEQ (4) , width->2) ; 
putC  ,*); 

put (tuple. GLOBAL  VARXABLES.ACK,  width  ->  3); 
putC  ]*); 
end  output_Gtuple; 

separata  (main) 

procedure  output_Gtuple_to_file (tuple  :  in  out  Gstate  record  type; 

counter  :  in  out  integer)  is~ 

begin 

put (reach, counter) ; 

put(reach,'  C  t  integer' image (tuple. machinel_state.state_number)  i  "  , ')  ; 
put (reach, integer' image (tuple .machine2_3tate . state  number) ) 7 
put  (reach,*  ,'*); 

put (reach, tuple .machine l_state . seq,  width  •>  1); 
put  (reach,*  ,  ") ;  ~ 

put (reach, tuple .machinel_state . i,  width  »>  1); 
put (reach,*  ,  *) ;  ~ 

put (reach, tuple .machine2_state .exp,  width  ->  1) ; 
put (roach,*  ,  ") ;  ~ 

put (roach, tuple .machine2_stace . j,  width  •>  1) ; 
put (reach, *  ,  ”); 

put (reach, tuple. GLOBAL_VARIABLES. DATA (1)  ,  width  ->3); 
put ( reach, tuple .GLOBAL^VARI ABLES .SEQ(l),width*>2); 
put ( reach, *  ,  ') ; 

put (reach, tuple. GLOBAL_VARIABLES. DATA(2) ,  width  ->3); 
put  (reach,  tuple. GL0BAL_VARIABLES.SEQ(2)  ,width=«>2)  ; 
put ( reach, *  , *) ; 

put (reach, tuple. GLOBAL  VARIABLES. 0ATA(3) ,  width  *>3); 
put  (reach,  tuple  .GLOBAL^VARIABLES  .  SEQ  (3) ,  width»2)  ; 
put  ( reach,  *  ,*); 

put (reach,  tuple. GLOBAL_VARIABLES .ACK,  width  •>  3) ; 
put ( reach, *  1 *)  ;  ~ 

new_i ine ( reach ) ; 
end  output_Gtuple_to_file; 


separate  (main) 

procedure  output_G3tate_node (Gstate  pointer  :  in  out  Glink  type; 

Error_riag  :  in  out  boolean)  is 


begin 

output_line_count  :•  output  line_count  »  1; 
if  ( (output~line_count  mod  TO)  =  0)  then 
scroll_pau3e; 
end  if; 

set_col (Gcolumn_set) ; 

put (Gstate_pointer.system_state_number,  width  •>  3) ; 
output_Gtuple (Gstate  pointer. Gtuple)  ; 

if  (  (Gstate_pointer .  Tinlcl  .Glin)c  •  null)  and  then  (Gstate_pointer  .  1  in)r2  .G1  in)t 


null) 
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and  Chen 

(Gatato_pointer .  Iink3  .Glinlc 

Chen 

Error_flaq  crue; 

else 

Error_flag  false; 

end  if;  ~ 

end  outpuC_GsCaCe_node; 


null)  and  Chen  (GsCaco_poincer .  limc-l  .Glink  -  null)) 
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OUTPUT 


REACHABILITY  ANALYSIS 
Global  Stace 

0  (0,0,0, 1,0, 1,E  -1,E 

1  (1,0,1,2,0,1,D00,E 

2  (2, 0,2, 3, 0,1,  DO  Q,D1 

4  (3, 0,3, 4, 0,1,  DO  Q,D1 

7  (4, 0,4, 1,0,1,  DO  0,D1 

12  t  4  ,  1  ,  4  ,  1  ,  1  ,  2  ,  E  -1  .  D1 

18  [4, 2, 4, 1,2, 3, E  -1,E 

26  [  4  ,  3  ,  4  ,  1  ,  3  ,  4  ,  E  -1  ,  E 

36  (  4  ,  4  ,  4  ,  1  ,  4  ,  1  ,  E  -1  ,  E 

47  :  4  ,  0  ,  4  ,  1  ,  4  ,  1  ,  E  -1  ,  E 

60  [  0  ,  0  ,  4  ,  1  ,  4  ,  1  ,  E  -1  ,  E 

72  [1,0, 0.2, 4,1,  DO  4,E 

87  (  2  .  0  ,  1  ,  3  ,  4  ,  1  ,  DO  4  ,  D1 

102  (  3  .  0  ,  2  ,  4  ,  4  ,  1  ,  DO  4  .  D1 

120  (  4  .  0  ,  3  ,  1  ,  4  ,  1  ,  DO  4  .  D1 

134  (  4  ,  1  ,  3  ,  1  ,  0  ,  2  ,  E  -1  .  01 

150  (  4  .  2  ,  3  ,  1  .  1  ,  3  ,  E  -1  .  E 

162  (  4  .  3  .  3  .  1  ,  2  .  4  ,  E  -1  .  E 

176  [  4  .  4  ,  3  ,  1  ,  3  ,  1  ,  E  -1  ,  E 

187  [  4  ,  0  ,  3  ,  1  ,  3  ,  1  ,  E  -1  ,  E 

200  [  0  .  0  ,  3  ,  1  ,  3  ,  1  ,  E  -1  ,  E 

212  (  1  .  0  .  4  ,  2  ,  3  ,  1  ,  00  3  ,  E 

227  (  2  ,  0  ,  0  ,  3  ,  3  ,  1  ,  00  3  ,  D1 

242  (  3  ,  0  ,  1  ,  4  ,  3  ,  1  ,  00  3  ,  01 

260  (  4  ,  0  ,  2  ,  1  ,  3  ,  1  ,  DO  3  ,  01 

274  (  4  ,  1  ,  2  ,  1  ,  4  ,  2  ,  E  -1  ,  01 

290  (  4  ,  2  ,  2  ,  1  ,  0  ,  3  ,  E  -1  ,  E 

302  (  4  ,  3  ,  2  ,  1  ,  1  ,  4  ,  E  -1  ,  E 

316  1  4  ,  4  ,  2  ,  1  ,  2  ,  1  ,  E  -1  ,  E 

327  (  4  ,  0  ,  2  ,  1  ,  2  ,  1  ,  E  -1  ,  E 

340  [  0  .  0  ,  2  ,  1  ,  2  ,  1  ,  E  -1  .  E 

352  (  1  ,  0  ,  3  ,  2  ,  2  ,  1  ,  DO  2  ,  E 

367  [  2  ,  0  ,  4  ,  3  ,  2  ,  1  ,  DO  2  ,  01 

382  (  3  ,  0  ,  0  ,  4  ,  2  ,  1  ,  DO  2  ,  Dl 

400  (  4  ,  0  ,  1  ,  1  ,  2  ,  1  ,  DO  2  ,  01 

414  r  4  ,  1  ,  1  ,  1  ,  3  ,  2  .  E  -1  ,  d: 

430  ;  4  ,  2  ,  1  ,  1  ,  4  ,  3  E  -I  ,  E 

442  :  4  ,  3  ,  1  ,  1  ,  0  ,  4  ,  E  -1  ,  E 

456  [  4  ,  4  ,  1  ,  1  ,  1  ,  1  ,  E  -1  ,  E 

467  :  4  ,  0  ,  1  ,  1  ,  1  ,  1  ,  E  -1  ,  E 

480  [  0  ,  0  ,  1  ,  1  ,  1  ,  1  ,  £  -1  ,  E 

4  92  [  1  ,  0  ,  2  ,  2  ,  1  ,  1  ,  DO  1  ,  E 

507  [  2  ,  0  ,  3  ,  3  ,  1  ,  1  ,  00  1  ,  01 

522  :  3  ,  0  ,  4  ,  4  ,  1  ,  1  ,  DO  1  ,  01 

540  {  4  ,  0  ,  0  ,  1  ,  1  ,  1  ,  00  1  .  01 

554  [  4  ,  1  ,  0  ,  1  ,  2  ,  2  ,  E  -1  ,  Dl 

570  (  4  ,  2  ,  0  ,  1  ,  3  ,  3  ,  E  -1  ,  E 

582  (  4  ,  3  ,  0  ,  1  ,  4  ,  4  ,  E  -1  ,  E 

596  (  4  ,  4  ,  0  ,  1  ,  0  ,  1  ,  E  -I  ,  E 

607  [  4  ,  0  ,  0  ,  1  ,  0  ,  :  ,  E  -1  .  E 

541  (  3  ,  1  ,  4  ,  4  ,  2  ,  2  ,  E  -1  ,  01 

555  (  3  ,  2  ,  4  ,  4  ,  3  ,  3  ,  E  -1  ,  E 
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514 

514 

[  3 

3 

2 

2  , 

2  , 

2 

E 

-1 

E 

-1 

E 

-1 

,  E 

-1  , 

-1  ] 

snd  data 
snd  ack 

530 

531 

531 

[  3 

0 

2 

2  , 

2  , 

2 

E 

-1 

E 

- 1 

E 

-1 

,E 

-1  , 

2  1 

rcv_ackO 

snd_data 

543 

551 

551 

(  4 

0 

3 

3  , 

2  , 

2 

E  -1 

01 

2 

E 

-1 

,  E 

-1  , 

2  1 

rcv_ackl 
rev  data 

557 

567 

567 

[  4 

1 

3 

3  , 

3  , 

3 

E  - ! 

“  L 

E 

-1 

,  E 

-1  , 

2  i 

rev  ackl 
snd  ack 

575 

566 

471 

[  2 

1 

1 

0  , 

4 

E  -1 

E 

-1 

,  03 

0  , 

~  1  i 

snd  data 
rev  data 

484 

485 

485 

1  2 

2 

1 

1  , 

1  , 

1 

£  “I 

E 

-  T 

E 

-1 

,  E 

-1  , 

■“  1  1 

snd  data 

497 

snd  ack  498 


212 


498  (  2  ,  0  ,  1  .  1  ,  1  ,  1  .  E  -1  ,  E 

515  (  3  ,  0  ,  2  .  2  ,  1  ,  1  ,  DO  1  .  E 

532  t  4  ,  0  .  3  ,  3  ,  1  ,  1  ,  DO  1  .  D1 

552  [  4  ,  1  ,  3  .  3  ,  2  ,  2  ,  E  -1  ,  D1 

568  (  4  ,  2  ,  3  .  3  ,  3  ,  3  ,  E  -1  ,  E 

533  (  3  .  1  ,  2  ,  2  ,  2  ,  2  ,  E  -1  ,  E 

460  (  1  ,  1  ,  0  ,  4  ,  0  .  4  ,  E  -1  .  E 

472  (  1  ,  0  ,  0  ,  4  ,  0  ,  4  ,  E  -1  .  E 

486  [  2  ,  0  ,  1  ,  1  ,  0  ,  4  ,  E  -1  .  E 

499  [  3  .  0  .  2  ,  2  ,  0  ,  4  ,  DO  1  .  E 

516  (  4  ,  0  ,  3  ,  3  ,  0  ,  4  ,  DO  1  ,  01 

534  [  4  ,  1  ,  3  ,  3  ,  1  ,  1  ,  DO  1  ,  01 

553  I  4  ,  2  ,  3  ,  3  ,  2  ,  2  ,  E  -1  ,  D1 

569  [  4  ,  3  ,  3  ,  3  .  3  ,  3  ,  E  -1  ,  E 

517  (  3  ,  1  ,  2  ,  2  ,  1  .  1  ,  DO  1  .  E 

535  (  3  ,  2  ,  2  ,  2  ,  2  ,  2  ,  E  -1  <  E 

500  !  2  ,  1  ,  1  ,  1  ,  1  ,  1  ,  E  -1  ,  E 

433  [  3  ,  0  ,  0  ,  4  ,  4  ,  3  ,  E  -1  ,  E 

445  I  4  ,  0  ,  1  ,  1  ,  11  ,  3  ,  E  -1  ,  E 

461  I  4  ,  1  ,  1  ,  1  ,  0  ,  4  ,  E  -1  ,  E 

473  (  4  ,  2  ,  1  ,  1  ,  1  ,  1  ,  E  -1  ,  E 

446  (  3  ,  1  ,  0  ,  4  ,  0  ,  4  ,  E  -I  ,  E 

368  (  1  ,  1  ,  3  ,  2  ,  3  ,  2  ,  E  -1  ,  E 

384  (  1  ,  0  ,  3  ,  2  ,  3  ,  2  ,  £  -1  ,  E 

403  (  0  ,  0  ,  3  ,  2  ,  3  ,  2  ,  E  -1  ,  E 

417  !  1  ,  0  ,  4  ,  3  ,  3  ,  2  ,  E  -1  ,  01 

434  (  2  ,  0  ,  0  ,  4  ,  3  ,  2  ,  E  -1  ,  01 

447  (  3  ,  0  ,  1  ,  1  ,  3  ,  2  ,  E  -1  ,  01 

462  1  4  ,  0  ,  2  ,  2  ,  3  ,  2  ,  DO  1  ,  01 

474  [  4  ,  1  ,  2  ,  2  ,  4  ,  3  ,  00  1  ,  E 

487  1  4  ,  2  ,  2  ,  2  ,  0  ,  4  ,  DO  1  ,  E 

5Q1  [  4  ,  3  ,  2  ,  2  ,  1  ,  1  ,  DO  1  ,  E 

518  (  4  ,  4  ,  2  ,  2  ,  2  ,  2  ,  E  -1  ,  E 

536  (  4  ,  0  ,  2  ,  2  ,  2  ,  2  ,  E  -1  ,  E 

463  (  3  ,  1  ,  1  ,  1  ,  4  ,  3  ,  E  -1  ,  E 

475  (  3  ,  2  ,  1  ,  1  ,  0  ,  4  ,  E  -1  ,  E 

488  I  3  ,  3  ,  1  ,  1  ,  1  ,  1  ,  E  -1  ,  E 


-1 

E 

-1 

,E 

-1  , 

1  1 

rcv_aclcO 

480 

snd_daca 

515 

-1 

E 

-1 

,E 

-1  , 

1  1 

rcv_ackl 

492 

snd_data 

532 

rcv_data 

533 

2 

E 

-1 

,E 

-1  , 

1  1 

rcv~aclc2 

507 

• 

rcv_data 

552 

2 

E 

-1 

,E 

-1  , 

1  1 

rcv_  aclc2 

523 

rcv^data 

568 

-1 

E 

-1 

,E 

-1  , 

1  1 

rcv~ack2 

542 

snd_ack 

566 

-1 

E 

-1 

,E 

-1  , 

1  ] 

ccv_ackl 

508 

snd~data 

552 

snd_ack 

531 

-1 

E 

-1 

,E 

-1  , 

-1  1 

snd~data 

471 

snd_ack 

472 

-1 

E 

-1 

,E 

-1  , 

0  ] 

rcv_ackO 

457 

snd_data 

486 

-1 

E 

-1 

,D3 

0  , 

0  ] 

rev  ackl 

4  68 

snd  data 

499 

rcv_data 

500 

-1 

E 

-1 

,03 

0  , 

0  ] 

rcv_ack2 

481 

snd_data 

516 

rcv_data 

517 

2 

E 

-1 

.03 

0  , 

0  ] 

rcv~ack3 

493 

rcv_data 

534 

2 

E 

-1 

,E 

-1  , 

0  1 

rcv_ack3 

510 

rev  data 

553 

2 

E 

-1 

,E 

-1  , 

0  ] 

rcv_ack3 

526 

rcv_data 

569 

-1 

E 

-1 

0 

-1  , 

0  1 

rcv~ack3 

546 

snd  ack 

566 

-1 

E 

-1 

,E 

-1  , 

0  ] 

rcv~ack2 

494 

snd'data 

534 

rcv~data 

535 

-1 

E 

-1 

,E 

-1  , 

0  1 

rcv~ack2 

511 

snd~data 

553 

snd_ack 

531 

-1 

E 

-1 

,E 

-1  , 

0  1 

rcv~ackl 

482 

snd~daca 

517 

0 

snd_ack 

498 

-1 

D2 

4 

,E 

-1  , 

4  ] 

rcv~ackl 

444 

snd_data 

445 

rcv~data 

446 

-1 

02 

4 

,03 

0  , 

4  1 

ccv~ack2 

459 

rcv_data 

461 

-1 

E 

-1 

,  03 

0  , 

4  1 

rcv_ack2 

471 

rcv~daca 

473 

-1 

E 

-1 

,  E 

-  i  , 

4  1 

rcv_ack2 

485 

snd_ack 

467 

-1 

E 

-1 

,  E 

-1  , 

4  1 

rcv_ackl 

460 

snd_data 

461 

snd  ack 

443 

-1 

E 

-1 

,E 

-1  , 

-1  1 

snd_data 

383 

snd  ack 

384 

-1 

E 

-1 

,E 

-1  , 

3  i 

rcv_ackO 

403 

snd_data 

404 

-1 

E 

-1 

,  E 

-1  , 

-1  I 

snd~data 

417 

3 

E 

-1 

,E 

-1  , 

-1  1 

snd_data 

434 

revdata 

435 

3 

02 

4 

,  E 

-1  , 

rl  : 

snd  data 

447 

rev  data 

448 

3 

02 

4 

,  D3 

0  , 

“  1  i 

snd  data 

462 

rev  data 

463 

3 

D2 

4 

,03 

0  , 

-1  1 

rev  data 

474 

-1 

02 

4 

,03 

0  , 

-1  1 

rev  data 

487 

-1 

E 

-1 

,03 

0  , 

-1  ) 

rev_data 

501 

-1 

E 

-1 

.E 

-1  , 

-1  1 

rev_data 

518 

-1 

E 

-1 

,E 

-1  , 

-1  1 

snd_aek 

536 

-1 

E 

-1 

,  E 

-1  , 

2  ) 

rev  aekO 

543 

-1 

D2 

4 

,03 

0  , 

-1  ] 

snd  data 

474 

rev  data 

475 

-1 

E 

-1 

,03 

0  , 

-1  ] 

snd  data 

487 

rev  data 

488 

-1 

E 

-1 

,  E 

-1  , 

-1  I 

snd_data 

501 

snd  aek 

502 

213 


502  (  3  ,  0  ,  1  .  1  ,  1  ,  1  ,  E  -1  . 

519  t  4  ,  0  ,  2  .  2  ,  1  ,  1  ,  DO  1  , 

537  [  4  ,  1  ,  2  ,  2  ,  2  ,  2  ,  E  -1  , 

448  (  2  ,  1  ,  0  ,  4  ,  4  ,  3  .  E  -1  , 

464  [  2  ,  2  ,  0  ,  4  ,  0  ,  4  ,  E  -1  , 

476  t  2  ,  0  ,  0  ,  4  ,  0  ,  4  ,  E  -1  , 

489  (  3  ,  0  ,  1  .  1  ,  0  ,  4  ,  E  -1  . 

503  [  4  ,  0  .  2  .  2  ,  0  ,  4  ,  DO  1  , 

520  [  4  ,  1  ,  2  .  2  .  1  ,  1  ,  DO  1  , 

538  [  4  ,  2  ,  2  .  2  ,  2  ,  2  ,  E  -1  , 

504  [  3  ,  1  .  1  ,  1  ,  1  ,  1  ,  E  -1  . 

435  [  1  ,  1  ,  4  .  3  .  4  ,  3  ,  E  -1  , 

449  i  1  ,  0  ,  4  ,  3  ,  4  ,  3  ,  E  -1  , 

465  [  2  ,  0  ,  0  ,  4  ,  4  ,  3  ,  E  -1  , 

477  (  3  ,  0  ,  1  ,  1  ,  4  ,  3  ,  E  -1  , 

490  (  4  ,  0  ,  2  ,  2  ,  4  ,  3  ,  DO  1  , 

505  (  4  ,  1  ,  2  ,  2  ,  0*,  4  ,  DO  1  , 

521  (  4  ,  2  ,  2  ,  2  ,  1  ,  1  ,  DO  1  , 

539  (  4  ,  3  ,  2  ,  2  ,  2  ,  2  ,  E  -1  , 

491  (  3  ,  1  ,  1  ,  1  ,  0  ,  4  ,  E  -1  , 

506  (  3  ,  2  ,  1  ,  1  ,  1  ,  1  ,  E  -1  , 

478  (  2  ,  1  ,  0  ,  4  .  0  ,  4  ,  E  -1  , 

404  (2,0,4,  ,  3  ,  2  ,  E  -I  , 

418  [  3  ,  0  ,  0  ,  4  ,  3  ,  2  ,  E  -I  , 

436  (  4  ,  0  ,  1  ,  1  ,  3  ,  2  ,  E  -1  , 

450  (  4  ,  1  ,  1  ,  1  ,  4  ,  3  ,  E  -1  , 

466  (  4  ,  2  ,  1  ,  1  ,  0  ,  4  ,  E  -1  , 

479  (  4  ,  3  ,  1  ,  1  ,  1  ,  1  ,  E  -1  , 

437  (  3  ,  1  ,  0  ,  4  ,  4  ,  3  ,  E  -1  , 

451  (  3  ,  2  ,  0  ,  4  ,  0  ,  4  ,  E  -1  , 

419  [  2  ,  1  ,  4  ,  3  ,  4  ,  3  ,  E  -I  , 

261  [  3  ,  1  ,  1  ,  4  ,  4  ,  2  ,  E  -1  , 
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492 

rcv_data 
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snd_ack 
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0 

E 
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snd  data 
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-1 

0 
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-1 
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0 

0 
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468 

snd_daCa 
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rcv~daCa 
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E 

-1 

0 

E 

-1 

,03 
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0 

0  ] 

rcv_ack2 
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rev  data 
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rcv_ack2 
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rcv_data 

538 
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snd_ack 

536 

E 

-1 

0 

E 

-1 

.E 

-1 

0 

3  1 
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snd_data 
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snd_ack 
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snd_data 
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5nd_ack 
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t 
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rcv_ackO 

432 

snd_dara 
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D2 

4 
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-1 
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rev  aekl 

444 

snd  data 

477 

rev_data 
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-1 
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rcv~aek2 

459 

snd~data 
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484 

rcv~data 

521 

E 

-1 

0 

E 

-1 

,E 

-1 

0 

4  : 

rcv~aek3 
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rcv~data 
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-1 

0 
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rcv_ack3 

514 

snd^ack 

536 

E 

“  1 

0 

E 

-1 

,  03 

0 

0 

4  ; 

rcv2aek2 

471 

snd_data 

505 

rcv~data 

506 

E 

-1 

E 

-1 

,  E 

-1 

0 

4  i 

rcv_ack2 

485 

snd_daca 

521 

snd_ack 

502 

E 

-1 

E 

-1 

,  E 

-1 

4  ; 

rcv_ackl 

460 

snd  data 

491 

snd  aek 

476 

D1 
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E 

-1 

,  E 

-1 

3  ; 

rev  aekl 

417 

3nd_data 

418 

rev  data 

419 

01 
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,  E 

-1 

3  ] 

rev  aek2 

434 

snd  data 
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rev  data 

437 

D1 

3 

02 

4 

,  03 

0 

3  ] 

rev  aek3 

447 

rev_data 
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E 

-1 

02 

4 

,  03 

0 

3  ] 

rcv~aek3 

463 

rev  data 

466 

-1 

E 

-1 

,  03 

0 

3  ; 

rev  aek3 

475 

rev_data 

479 

£ 

■  1 
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-1 

,E 

-1 

3  1 

rev~aek3 

488 

snd_aek 

467 
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-1 

02 

4 

,E 

-1 

3  : 

rcv_aek2 

448 

snd_data 

450 

rcv_data 

451 
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-1 
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-1 

,  E 

-1 

3  : 

rcv_aek2 

464 

snd  data 

466 

snd  aek 

443 
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-1 

F 

-1 
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-1 

3  ; 

rcv_aekl 

435 

snd_data 

437 

snd_aek 
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01 

4 

02 

0 

,  E 

-1 

-1  : 

snd  data 
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rev  data 
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275  [  3  .  2  ,  1  ,  4  ,  0  ,  3  ,  E  -1  ,  E  -1  .  02  0  ,E  -1,-1]  snd_data  290 

rcv_data  291 

291  (  3  ,  3  ,  1  ,  4  ,  1  ,  4  ,  E  -1  .  E  -1  ,  E  -1  ,E  -1,-1]  snd_data  302 

snd_aclc  303 

303  (  3  ,  0  ,  1  ,  4  .  1  ,  4  ,  E  -1  ,  E  -1  ,  E  -1  ,E  -1  ,  1  ]  rcv_aclc0  317 

snd  data  318 

317  (  0  ,  0  ,  1  ,  4  ,  1  ,  4  ,  E  -1  ,  E  -1  ,  E  -1  ,E  -1,-1]  snd~data  328 

328  [  1  ,  0  .  2  .  1  ,  1  ,  4  ,  E  -1  ,  E  -1  ,  E  -1  ,D3  1,-1]  snd_data  341 

rcv~data  342 

341  (  2  ,  0  ,  3  ,  2  ,  1  ,  4  ,  DO  2  ,  E  -1  .  E  -1  ,D3  1,-1]  snd~data  353 

rcv_data  354 

353  (  3  ,  0  ,  4  ,  3  ,  1  ,  4  ,  DO  2  .  D1  3  ,  E  -1  ,D3  1,-1]  snd_data  369 

rcv~data  370 

369  I  <1  ,  0  .  0  ,  4  ,  1  ,  4  ,  DO  2  .  01  3  ,  D2  4  ,  D3  1,-1]  rcv_data  385 

385  (  4  .  1  .  0  ,  4  ,  2  ,  1  ,  DO  2  ,  D1  3  ,  D2  4  ,E  -1,-1]  rcv_daCa  405 

405  [  4  ,  2  ,  0  ,  4  ,  3  ,  2  ,  E  -1  ,  D1  3  ,  D2  4  ,E  -1,-1]  rcv_data  420 

420  [  4  ,  3  ,  0  ,  4  ,  4  ,  3  ,  E  -1  ,  E  -1  ,  D2  4  ,E  -1  ,  -1  ]  rev  data  438 

438  [  4  ,  4  ,  0  ,  4  ,  0  ,  4  ,  E  -1  ,  E  -1  ,  E  -1  ,E  -1,-1]  snd~ac)c  452 

452  (  4  ,  0  ,  0  .  4  ,  0  ,  4  ,  E  -1  ,  E  -1  .  E  -1  ,E  -1  ,  0  ]  rcv_acJcO  457 

370  (  3  ,  1  ,  4  ,  3  ,  2  ,  1  ,  DO  2  ,  01  3  ,  E  -1  ,E  -1,-1]  snd_data  385 

rcv_data  386 

386  (  3  ,  2  .  4  .  3  .  3  ,  2  ,  E  -1  .  D1  3  ,  E  -1  .E  -1,-1]  snd_data  405 

rev  data  406 

406  (  3  .  3  .  4  .  3  .  4  ,  3  ,  E  -1  ,  E  -1  ,  E  -1  ,E  -1,-1]  snd_data  420 

snd  acic  421 

421  (  3  ,  0  ,  4  ,  3  ,  4  ,  3  ,  E  -1  ,  E  -1  ,  E  -1  ,E  -1  ,  4  ]  rcv'ackO  432 

snd~data  439 

439  (  4  ,  0  ,  0  ,  4  ,  4  ,  3  .  E  -1  ,  E  -1  ,  D2  4  ,E  -1  ,  4  ]  rcv_aclcl  444 

rev  data  453 

453  (  4  ,  1  ,  0  ,  4  ,  0  ,  4  .  E  -1  ,  E  -1  ,  E  -1  ,E  -1  ,  4  ]  rev'aeki  460 

snd~aelc  452 

354  (  2  ,  1  ,  3  ,  2  ,  2  ,  1  ,  DO  2  ,  E  -1  ,  E  -1  ,E  -1,-1]  snd_data  370 

rev  data  371 

371  (  2  ,  2  ,  3  ,  2  ,  3  ,  2  ,  E  -1  ,  E  -1  ,  E  -1  ,E  -1,-1]  snd'data  386 

snd~ae)c  387 

387  (  2  ,  0  ,  3  ,  2  ,  3  ,  2  ,  E  -1  ,  E  -1  ,  E  -1  ,E  -1  ,  .3  1  XCV^acItO  403 

snd_data  407 

407  (  3  ,  0  ,  4  ,  3  ,  3  ,  2  ,  E  -1  ,  01  3  ,  E  -1  ,E  -1  ,  3  ]  rev_ae)cl  417 

snd~data  422 
rcv~data  423 

422  (  4  ,  0  ,  0  ,  4  ,  3  ,  2  ,  E  -1  ,  01  3  ,  D2  4  ,E  -1  ,  3  ]  rev;;;ae)c2  434 

rev~data  440 

440  (  4  ,  1  ,  0  ,  4  ,  4  ,  3  ,  E  -1  ,  E  -1  ,  D2  4  ,E  -1  ,  3  ]  rcv~acic2  448 

rcv~data  454 

454  (  4  ,  2  ,  0  ,  4  ,  0  ,  4  ,  E  -1  ,  E  -1  ,  E  -1  ,E  -1  ,  3  ]  rcv_ae)c2  464 

snd  ack  452 

423  (  3  ,  1  ,  4  ,  3  ,  4  ,  3  ,  E  -1  ,  E  -1  ,  E  -1  ,E  -1  ,  3  ]  rcv^aclcl  435 

snd_data  440 
snd  acIc  421 

342  (  1  ,  1  ,  2  ,  1  ,  2  ,  1  ,  E  -1  ,  E  -1  ,  E  -1  ,E  -1,-1]  snd'data  354 

snd_ack  355 

355  :  1  ,  0  ,  2  ,  1  ,  2  ,  1  ,  E  -1  ,  E  -1  ,  E  -1  ,E  -1  ,  2  1  rcv_ackO  340 

snd_data  372 

372  [  2  ,  0  ,  3  ,  2  ,  2  ,  1  ,  DO  2  ,  E  -1  ,  E  -1  ,E  -1  ,  2  ]  rcv_aelcl  352 

snd_data  388 
rcv_data  389 

388  [  3  ,  0  ,  4  ,  3  ,  2  ,  1  ,  DO  2  ,  D1  3  ,  E  -1  ,E  -1  ,  2  ]  rcv_ae)c2  367 

snd_data  408 
rcv_data  409 

408  [  4  ,  0  ,  0  ,  4  ,  2  ,  1  ,  00  2  ,  D1  3  ,  D2  4  ,E  -1  ,  2  1  rcv_ack3  382 

rcv_da':a  42  4 

424  :  4  ,  1  ,  0  ,  4  ,  3  ,  2  ,  E  -1  ,  01  3  ,  D2  4  ,E  -1  ,  2  )  rcv_ac)c3  401 

rcv_data  441 

441  (  4  ,  2  ,  0  ,  4  ,  4  ,  3  ,  E  -1  ,  E  -1  ,  D2  4  ,E  -1  ,  2  ]  rev_aelc3  415 

rcv_data  455 

455  (  4  ,  3  ,  0  ,  4  ,  0  ,  4  ,  E  -1  ,  E  -1  ,  E  -1  ,E  -1  ,  2  ]  rcv_ack3  431 

snd_ac)c  452 

409  [  3  ,  1  ,  4  ,  3  ,  3  ,  2  ,  E  -1  ,  Di  3  ,  E  -1  ,E  -1  ,  2  ]  rcv_ack2  383 

snd_data  424 
rcv_data  425 

425  (  3  ,  2  ,  4  ,  3  ,  4  ,  3  ,  E  -1  ,  E  -1  ,  E  -1  ,E  -1  ,  2  i  rcv_ack2  402 

snd_data  441 
snd_ack  421 

389  (  2  ,  1  ,  3  ,  2  ,  3  ,  2  ,  E  -1  ,  E  -1  ,  E  -1  ,E  -1  ,  2  ]  rcv_ackl  368 

snd_data  409 
snd  ack  387 
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318  (  4  ,  0  ,  2  ,  1  ,  1  ,  4  ,  E  -1 

329  [  4  ,  1  ,  2  ,  1  ,  2  .  1  ,  E  -1 

243  (  2  .  1  ,  0  ,  3  ,  4  ,  2  ,  E  -1 

262  (  2  ,  2  ,  0  ,  3  .  0  ,  3  ,  E  -1 

276  (  2  ,  0  ,  0  ,  3  ,  0  ,  3  ,  E  -1 

292  [  0  ,  0  ,  0  ,  3  ,  0  ,  3  .  E  -1 

304  (  1  .  0  ,  1  .  4  ,  0  ,  3  ,  E  -1 

319  (  2  ,  0  .  2  .  1  .  0  ,  3  ,  E  -1 

330  [  3  ,  0  ,  3  .  2  .  0  .  3  .  DO  2 

343  [  4  .  0  ,  4  ,  3  ,  0  ,  3  ,  DO  2 

356  (  4  .  1  ,  4  .  3  ,  1  ,  4  ,  DO  2 

373  (  4  .  2  .  4  ,  3  ,  2  ,  1  ,  DO  2 

390  [  4  .  3  .  4  ,  3  ,  3  ,  2  .  E  -1 

410  [  4  ,  4  .  4  ,  3  ,  4  ,  3  ,  E  -1 

426  (  4  ,  0  .  4  ,  3  .  4  .  3  ,  E  -1 

344  (  3  ,  1  ,  3  ,  2  ,  1  ,  4  .  DO  2 

357  [  3  ,  2  .  3  ,  2  ,  2  ,  1  ,  DO  2 

374  I  3  .  3  .  3  ,  2  ,  3  ,  2  ,  E  -1 

391  (  3  ,  0  .  3  .  2  ,  3  ,  2  ,  E  -1 

411  (  4  ,  0  .  4  ,  3  ,  3  ,  2  ,  E  -1 

427  (  4  ,  1  ,  4  ,  3  ,  4  ,  3  ,  E  -1 

331  (  2  ,  1  .  2  ,  1  ,  1  ,  4  ,  E  -1 

345  (  2  ,  2  .  2  ,  1  ,  2  ,  1  ,  E  -1 

358  (  2  ,  0  ,  2  ,  1  ,  2  ,  1  ,  E  -1 

375  (  3  ,  0  ,  3  ,  2  ,  2  ,  1  ,  DO  2 

392  (  4  ,  0  ,  4  ,  3  ,  2  ,  1  ,  DO  2 

412  (  4  ,  1  ,  4  ,  3  ,  3  ,  2  ,  E  -1 

428  1  4  ,  2  ,  4  ,  3  ,  4  ,  3  ,  E  -1 

393  (  3  ,  1  ,  3  ,  2  ,  3  ,  2  ,  E  -1 

320  (  1  ,  1  ,  1  ,  4  ,  1  ,  4  ,  E  -1 

332  I  1  ,  0  ,  1  ,  4  ,  1  ,  4  ,  E  -1 

346  :  2  ,  0  ,  2  ,  1  ,  1  ,  4  ,  E  -1 

359  (  3  ,  0  ,  3  ,  2  ,  1  ,  4  ,  DO  2 

376  :  4  ,  0  ,  4  ,  3  ,  1  ,  4  ,  DO  2 

394  I  4  ,  1  ,  4  ,  3  ,  2  ,  1  ,  DO  2 

413  1  4  ,  2  ,  4  ,  3  ,  3  ,  2  ,  E  -1 

429  :  4  ,  3  ,  4  ,  3  ,  4  ,  3  ,  E  -1 

377  [  3  ,  1  ,  3  ,  2  ,  2  ,  1  ,  DO  2 

395  (  3  ,  2  ,  3  ,  2  ,  3  ,  2  ,  E  -1 


E 

-1 

E 

-1 

,D3 

1 

1  1 

rcv_ac)cl 

328 

rcv_data 

329 

E 

-1 

E 

-1 

.E 

-1 

1  1 

ccv_aclcl 

342 

snd_aclc 

327 

Dl 

4 

E 

-1 

.E 

-1 

-1  1 

snd_daca 

261 

rcv_data 

262 

E 

-1 

E 

-1 

.E 

-1 

-1  ] 

snd_daca 

275 

snd_ack 

276 

E 

-1 

E 

-1 

,E 

-1 

0  ) 

rcv_aclcO 

292 

snd~daca 

293 

E 

-1 

E 

-1 

,E 

-1 

-1  ) 

snd_data 

304 

E 

-1 

D2 

0 

.E 

-1 

-1  1 

snd_daca 

319 

rcv“data 

320 

E 

-1 

D2 

0 

,D3 

1 

-1  1 

snd~data 

330 

rcv_data 

331 

E 

-1 

D2 

0 

,D3 

1 

-1  ) 

snd_data 

343 

rcv_data 

344 

Dl 

3 

D2 

0 

.D3 

1 

-1  1 

rcv_data 

356 

Dl 

3 

E 

-1 

.D3 

1 

-1  ] 

ccv_data 

373 

Dl 

3 

E 

-1 

.E 

-1 

-1  ] 

rcv_daca 

390 

Dl 

3 

E 

-1 

.E 

-1 

-1  1 

ccv~data 

410 

E 

-1 

E 

-1 

,E 

-1 

-1  ] 

snd_aclc 

426 

E 

-1 

E 

-1 

,E 

-1 

4  1 

rcv_ackO 

432 

E 

-1 

E 

-1 

,D3 

1 

-1  1 

snd_data 

356 

rcv_data 

357 

E 

-1 

E 

-1 

.E 

-1 

-1  ] 

snd_daca 

373 

rcv_data 

374 

E 

-1 

E 

-1 

,E 

-1 

-1  1 

snd~data 

390 

snd_ac)c 

391 

E 

-1 

E 

-1 

,E 

-1 

3  1 

rcv_aclcO 

403 

snd_data 

411 

Dl 

3 

£ 

-1 

,E 

-1 

3  ! 

rcv_ackl 

417 

rcv_data 

427 

E 

-1 

E 

-1 

,  E 

-1 

3  ] 

rcv~ackl 

435 

snd~ack 

426 

E 

-1 

E 

-1 

,  D3 

1 

-1  1 

snd~data 

344 

rcv^data 

345 

E 

-1 

E 

-1 

,£■ 

-r 

-1  1 

snd~data 

357 

snd^ack 

358 

E 

-1 

E 

-1 

,E 

-1 

2  ] 

rcv“ackO 

340 

snd~data 

375 

E 

-1 

E 

-1 

,E 

-1 

2  1 

rcv~ackl 

352 

snd~data 

392 

rcv'data 

393 

Dl 

3 

E 

-1 

,E 

-1 

2  1 

rcv_ack2 

367 

rcv~daca 

412 

Dl 

3 

E 

-1 

,E 

-1 

2  ) 

rcv~ack2 

383 

rcv~data 

428 

E 

-1 

E 

-1 

.E 

-1 

2  ) 

rcv~ack2 

402 

snd_ack 

426 

E 

-1 

E 

-1 

.  E 

-1 

2  1 

rcv_ackl 

368 

snd_daca 

412 

snd_ack 

391 

E 

—  ^ 

E 

-1 

,E 

-1 

-1  1 

snd_data 

331 

snd  ack 

332 

E 

-1 

E 

-1 

,  E 

-1 

1  1 

rcv_ackO 

317 

snd_data 

346 

E 

-1 

E 

-1 

,  D3 

1 

1  1 

rcv_ackl 

328 

snd_daca 

359 

rcv_data 

360 

E 

*  1 

E 

-1 

,  D3 

1 

1  1 

rcv_ack2 

341 

snd  daca 

376 

rev  data 

377 

Dl 

3 

£ 

-1 

,  D3 

1 

1  1 

ccv_ack3 

353 

rcv_data 

394 

Dl 

3 

£ 

-1 

,  E 

1  1 

rcv_ack3 

370 

rcv_daca 

413 

Dl 

3 

E 

-1 

,E 

-1 

1  1 

rcv_ack3 

386 

rcv_data 

429 

E 

-1 

E 

-1 

,  E 

-  1 

1  1 

rcv_ack3 

406 

snd  ack 

426 

c 

-1 

E 

- 1 

.  E 

-1 

1  ) 

rcv_ack2 

354 

snd_data 

394 

rcv_daca 

395 

E 

-1 

E 

-1 

,E 

-1 

1  1 

rev  ack2 

371 

snd  data 

413 

« 


216 


360 

(  2 

1 

2 

1  , 

2  , 

1 

Z 

-1 

E 

-1 

0 

z 

-1 

.E 

-1  , 

1  ] 

snd_ac)c 

rcv~ackl 

391 

342 

293 

(  3 

0 

1 

t 

4  , 

0  , 

3 

Z 

-1 

E 

-1 

0 

D2 

0 

-1  , 

0  i 

snd_data 

snd~acli 

rov~ac)cl 

377 

358 

304 

305 

(  4 

0 

2 

0 

1  , 

0  , 

3 

Z 

-1 

E 

-1 

0 

02 

0 

,03 

1  , 

0  ] 

3nd_data 

rcv~data 

rcv_ack2 

305 

306 
319 

321 

1  4 

1 

2 

0 

1  . 

1  , 

4 

E 

-1 

E 

-1 

0 

£ 

-1 

,03 

1  , 

0  ] 

rcv_data 

rcv_ac)c2 

321 

331 

333 

:  4 

2 

2 

0 

1  , 

2  . 

1 

E 

-1 

E 

-1 

0 

E 

-1 

,E 

-1  , 

0  1 

rcv_data 

rcv_aclc2 

333 

345 

306 

1  3 

1 

1 

0 

4  . 

1  . 

4 

E 

-1 

£ 

-1 

0 

E 

-1 

,E 

-1  , 

0  ] 

snd^aclc 

rcv_aclcl 

327 

320 

228 

[  1 

1 

4 

0 

2  , 

4  . 

2 

E 

-1 

E 

-1 

0 

E 

-1 

,E 

-1  , 

-1  1 

snd_daca 

snd_aclc 

3nd_data 

321 

303 

243 

244 

(  1 

0 

4 

0 

2  , 

4  , 

2 

E 

-1 

E 

-1 

0 

E 

-1 

,E 

-1  , 

4  1 

snd_ac]c 

rcv_ackO 

244 

263 

263 

[  0 

0 

4 

0 

2  , 

4  , 

2 

£ 

-1 

E 

-1 

0 

E 

-1 

,E 

-1  , 

-1  ' 

snd_daCa 

snd_data 

264 

277 

277 

[  1 

0 

0 

0 

3  , 

4  , 

2 

E 

-1 

D1 

4' 

0 

E 

-1 

,E 

-1  , 

-1  : 

snd~daCa 

294 

294 

(  2 

0 

1 

0 

4  , 

4  , 

2 

E 

-1 

D1 

4 

0 

D2 

0 

,E 

-1  , 

-1  ; 

rcv_data 

snd~daca 

295 

307 

307 

(  3 

0 

2 

1  , 

4  , 

2 

E 

-1 

D1 

4 

0 

D2 

0 

,  03 

1  , 

-1  : 

rcv~data 

snd_daC.a 

308 

322 

322 

(  4 

0 

3 

0 

2  , 

4  , 

2 

DO 

2 

D1 

4 

0 

D2 

0 

,  03 

1  , 

-1  : 

rev  dara 
rcv_data 

323 

334 

334 

(  4 

1 

3 

0 

2  , 

0  , 

3 

DO 

2 

E 

-1 

0 

D2 

0 

,  03 

1  , 

-1  : 

rcv_data 

347 

347 

(  4 

2 

3 

0 

2  , 

1  , 

4 

DO 

2 

E 

-1 

0 

E 

-1 

,03 

1  , 

-1  : 

rcv_data 

361 

361 

(  4 

3 

3 

0 

2  , 

2  , 

1 

DO 

2 

E 

-1 

0 

E 

-1 

,E 

-1  , 

-1  ; 

rcv_data 

378 

378 

(  4 

4 

3 

0 

2  , 

3  , 

2 

E 

-1 

E 

-1 

0 

E 

-1 

,E 

-1  , 

-1  : 

snd_ac)t 

396 

396 

(  4 

0 

3 

0 

2  , 

3  , 

2 

E 

-1 

E 

-1 

0 

£ 

-1 

,E 

-1  , 

3  ; 

rcv~aclc0 

403 

323 

(  3 

1 

2 

0 

1  , 

0  , 

3 

E 

-1 

E 

-1 

0 

D2 

0 

,03 

1  , 

-1  ; 

snd~data 

334 

335 

(  3 

2 

2 

* 

1  , 

1  , 

4 

E 

-1 

E 

-1 

0 

E 

-1 

,03 

1  , 

-1  ; 

rcv~data 

snd'data 

335 

347 

348 

(  3 

3 

2 

* 

1  , 

2  , 

1 

E 

-1 

E 

-1 

0 

E 

-1 

,E 

-1  , 

-1  : 

rcv~data 

snd”data 

348 

361 

362 

(  3 

0 

2 

0 

1  , 

2  , 

1 

E 

-1 

E 

“  1 

0 

£ 

-1 

,E 

-1  , 

2  1 

sndjack 

rcv~ackO 

362 

340 

379 

(  4 

0 

3 

0 

2  , 

2  , 

1 

DO 

2 

E 

-1 

0 

£ 

-1 

,E 

-1  , 

2  1 

snd_data 

rcv_ackl 

379 

352 

397 

(  4 

1 

3 

0 

2  , 

3  , 

2 

E 

-1 

E 

-1 

0 

e 

-1 

,E 

-1  , 

2  1 

ccv_data 

rcv_ackl 

397 

368 

308 

[  2 

1 

1 

0 

4  , 

0  , 

3 

£ 

-1 

E 

-1 

0 

02 

0 

,E 

-1  , 

-1  1 

snd~ack 

snd_data 

396 

323 

324 

(  2 

2 

1 

0 

4  , 

1  , 

4 

E 

-1 

E 

-1 

E 

-1 

,E 

-1  , 

-1  1 

rcv_data 

snd_data 

324 

335 

336 

1  2 

0 

1 

0 

4  , 

1  , 

4 

E 

-1 

E 

-1 

E 

-1 

,E 

-1  , 

1  ] 

snd  ack 
rcv_ackO 

336 

317 

349 

(  3 

0 

2 

0 

1  , 

1  , 

4 

E 

-1 

E 

-1 

E 

-1 

,03 

1  , 

1  1 

snd  data 
rcv_ackl 

349 

328 

363 

(  4 

0 

3 

0 

2  , 

1  , 

4 

DO 

2 

E 

-1 

£ 

-1 

,  03 

1  , 

1  1 

snd  data 
rev  data 
rcv_ack2 

363 

364 
341 

380 

[  4 

1 

3 

f 

2  , 

2  , 

1 

DO 

2 

E 

-  i 

£ 

-1 

,  E 

-1  , 

’l  i 

rcv_data 

1  rov_ack2 

380 

354 

398 

(  4 

2 

3 

0 

2  , 

3  , 

2 

E 

-  1 

E 

-1 

E 

-1 

,  E 

- 1  , 

1  ; 

rcv_data 
!  rev  ack2 

398 

371 

364 

(  3 

1 

2 

t 

2  , 

E 

E 

£ 

-1 

,  E 

-1  , 

snd  ack 

1  rev  ackl 

ig*- 

342 

295 

[  1 

1 

0 

3  , 

0  , 

3 

E 

-1 

E 

-1 

E 

-1 

,E 

-1  , 

-1  1 

snd  data 
snd  ack 

1  snd_daca 

380 

362 

308 

309 

!  1 

0 

0 

3  , 

0  , 

3 

E 

-1 

E 

-1 

E 

-1 

,E 

-1  , 

0  1 

snd  ack 

1  rev  ackO 

309 

292 

325 

(  2 

0 

1 

4  , 

0  , 

3 

E 

-1 

E 

-1 

02 

0 

,  E 

-1  , 

0  1 

snd_data 

1  rcv_ackl 

325 

304 

337 

1  3 

0 

2 

1  , 

0  , 

3 

c 

-i 

E 

-1 

02 

0 

,03 

1  , 

0  1 

3nd_data 
rev  data 
rcv_ack2 

337 

338 
319 

350 

t  4 

0 

3 

2  , 

0  , 

3 

DO 

2 

E 

02 

0 

,  03 

0  : 

snd_data 

rcv_data 

1  rev  ack3 

350 

351 
330 

365 

(  4 

1 

3 

2  , 

1  , 

4 

DO 

2 

E 

-1 

E 

-1 

,  03 

1  , 

0  : 

rev  data 

1  rev  ack3 

365 

344 

217 


rev  data  381 


381 

(  4  , 

2  , 

3  , 

2  , 

2  , 

1  , 

DO 

2 

E 

-1 

t 

E 

-1 

,E 

-1  , 

0  ] 

rcv~aclc3 

357 

ccv_data 

399 

399 

(  4  , 

3  , 

3  , 

2  , 

3  , 

2  , 

E 

-1 

E 

-1 

0 

E 

-1 

,E 

-1  , 

0  ] 

rcv~ac)c3 

374 

snd_aclc 

396 

351 

[  3  , 

1  . 

2  , 

1  , 

1  , 

4  , 

E 

-1 

E 

-1 

0 

E 

-1 

,03 

1  , 

0  ] 

rcv~ack2 

331 

snd_daca 

365 

rcv_data 

366 

366 

[  3  , 

2  , 

2  , 

1  , 

2  , 

1  , 

E 

-1 

E 

-1 

0 

E 

-1 

,E 

-1  , 

0  1 

rcv“ac)c2 

345 

snd_data 

381 

and  ack 

362 

338 

[  2  , 

1  . 

1  . 

4  , 

1  . 

4  , 

E 

-1 

E 

-1 

0 

E 

-1 

,E 

-1  , 

0  : 

rcv_ac)cl 

320 

snd_daCa 

351 

snd_aclc 

336 

264 

[  2  , 

0  . 

0  . 

3  , 

4  , 

2  , 

E 

-1 

D1 

4 

0 

E 

-1 

.E 

-1  , 

4  ; 

rcv_ac)cl 

277 

snd_daCa 

278 

rcv_data 

279 

278 

(  3  . 

0  , 

1  . 

4  , 

4  , 

2  , 

E 

-1 

D1 

4 

0 

D2 

0 

,E 

-1  , 

4  : 

rcv_aclc2 

294 

snd_daCa 

296 

rcv_data 

297 

296 

(  4  . 

0  , 

2  . 

1  , 

4  , 

2  , 

E 

-1 

D1 

4 

0 

D2 

0 

,03 

1  , 

4 

rcv_ac)c3 

307 

rcv“data 

310 

310 

[  4  , 

1  , 

2  . 

1  , 

0  . 

3  , 

E 

-1 

E 

-1 

0 

D2 

0 

,03 

1  , 

4 

rcv~ack3 

323 

rcv_data 

326 

326 

[  4  , 

2  , 

2  , 

1  , 

1  , 

4  , 

E 

-1 

£ 

-1 

0 

E 

-1 

,  03 

1  , 

4 

rcv_ack3 

335 

rcv_data 

339 

339 

[  4  , 

3  , 

2  , 

1  , 

2  , 

1  , 

E 

-1 

£ 

-1 

E 

-1 

,E 

-1  , 

4 

rcv_aclc3 

348 

snd_aclc 

327 

297 

[  3  , 

1  , 

1  , 

4  , 

0  , 

3  , 

E 

-1 

E 

-1 

0 

D2 

0 

,E 

-1  , 

4 

rcv_ac)c2 

308 

snd_data 

310 

rcv_data 

311 

311 

[  3  . 

2  , 

1  , 

4  , 

1  , 

4  , 

E 

-1 

E 

-1 

0 

£ 

-1 

,E 

-1  , 

4  : 

rcv_acjc2 

324 

snd_data  326 
snd~ac)c  303 


279 

:  2  , 

.  1  , 

0  , 

,  3 

0  , 

3  , 

E  -1  , 

E 

- 1  , 

E 

-1 

,E 

*1  , 

4  : 

rcv_ackl 

snd^data 

snd”ack 

295 

297 

276 

121 

(  3  , 

1  , 

2  , 

,  4 

0  , 

2  , 

E  -1  . 

01 

0  , 

02 

1 

,E 

-1  , 

-1  i 

snd~data 

rev'data 

134 

135 

135 

[  3  , 

2  , 

2  , 

4 

1  , 

3  , 

E 

-1  , 

E 

02 

1 

,E 

-1  , 

-1  ! 

snd'data 

rcv_data 

150 

151 

151 

[  3  , 

3  , 

2  , 

4 

2  , 

4  , 

0  -1  , 

£ 

-1  , 

E 

-1 

,E 

-1  , 

-1  1 

spid^data 

snd~ack 

162 

163 

163 

(  3  , 

0  , 

2  , 

4 

2  , 

4  , 

E  '-1  , 

E 

-1  , 

E 

-1 

,E 

-1  , 

2  ; 

rcv_ac)cO 

snd~data 

177 

178 

177 

:  0  , 

0  , 

2  , 

4 

2  . 

4  , 

£ 

-1  , 

E 

-1  , 

E 

-1 

,E 

-1  , 

-1  1 

snd~data 

138 

188 

(  1  , 

0  , 

3  , 

1 

2  , 

4  , 

E 

-1  , 

E 

-1  , 

E 

-1 

,03 

2  , 

-1  i 

snd~data 

rcv_data 

201 

202 

201 

[  2  , 

0  , 

4  , 

2 

2  , 

4  , 

00 

3  , 

E 

-1  , 

E 

-1 

,03 

2  , 

-1  1 

snd~daCa 

rcv_data 

213 

214 

213 

(  3  , 

0  , 

0  , 

3 

2  , 

4  , 

DO 

3  , 

01 

4  , 

E 

- 1 

,03 

2  , 

-1  1 

snd~data 

rcv_daca 

229 

230 

229 

[  4  , 

0  , 

1  , 

4 

2  , 

4  , 

DO 

3  , 

01 

4  , 

02 

0 

,  03 

2  , 

-1  1 

rcv_data 

245 

245 

(  4  , 

1 

1  , 

4 

3  , 

1  , 

DO 

3  , 

D1 

4  , 

D2 

0 

,  E 

-1  , 

-1  ; 

rev  data 

265 

2  65 

(  4  , 

2 

1  , 

4 

4  , 

2  , 

E  -1  , 

D 1 

4  , 

02 

n 

yj 

,  E 

- 1 

-1  i 

rev  data 

280 

280 

(  4  , 

3  , 

1  , 

4 

0  , 

3  , 

E  •  1  a 

E 

-1  , 

02. 

0 

,E 

-1  ! 

-1  ] 

rev_data 

298 

298 

(  4  , 

4  , 

1  , 

4 

1  , 

4  , 

E  *1  » 

E 

-1  , 

E 

-1 

,E 

-1  , 

-1  1 

snd  ack 

312 

312 

(  4  , 

0  , 

1  , 

4 

1  , 

4  , 

E 

-  1  , 

-1  , 

£ 

-1 

,  E 

-1  , 

1  ] 

rev_aekO 

317 

230 

(  3  , 

1  , 

0  , 

3 

3  , 

1  , 

DO 

3  , 

D1 

4  , 

E 

-1 

,E 

-1  , 

-1  1 

snd_data 

rev~data 

245 

246 

246 

[  3  , 

2  , 

0  , 

3 

4  , 

2  , 

Dl 

4  , 

E 

-1 

,  E 

■“1  , 

-1  1 

snd  data 
rev  data 

265 

266 

266 

[  3  , 

3  , 

0  , 

3 

0  , 

3  , 

E  -I  , 

r 

“1  , 

E 

"  i 

,  E 

-  L  , 

-1  j 

snd_data 

snd_aek 

280 

281 

281 

(  3  , 

0  , 

0  , 

3 

0  , 

3  , 

E  -1  , 

E 

-1  , 

E 

-1 

,E 

-1  , 

0  1 

rev  ackO 
snd  data 

292 

299 

299 

!  4  , 

0  , 

1  , 

4 

0  , 

3  , 

E 

“a  , 

S 

02 

0 

,E 

-1  , 

0  1 

rev_aekl 

rev_data 

304 

313 

313 

!  4  , 

1  , 

1  . 

4 

■ 

4  , 

E 

-1  , 

E 

-1  , 

£ 

-1 

,  E 

-1  , 

0  1 

rev_aekl 
snd  aek 

320 

312 

214 

(  2  , 

1  , 

4  , 

2 

3  , 

^  , 

DO 

3  , 

E 

- 1  , 

E 

-1 

,  E 

-1  , 

-1  1 

1  snd_data 
rcv_data 

230 

231 

231 

[  2  , 

2  , 

4  , 

2 

4  , 

.  2  , 

w,  ”  i  , 

E 

•  1  , 

£ 

-1 

,  E 

■“  L  , 

-1  ; 

1  snd  data 
snd  aek 

246 

247 

247 

!  2  , 

0  , 

4  , 

2 

4  , 

.  2  , 

E  -1  , 

E 

-1  , 

E 

-1 

,E 

-1  , 

4  ; 

i  rcv_aekO 
snd  data 

263 

267 

218 


267 

[ 

3 

0  . 

0  , 

3  , 

4  , 

2 

E 

-1 

01 

4 

E 

-1 

,E 

-1 

4  : 

rcv_ackl 

snd~data 

rev^data 

277 

282 

283 

282 

: 

4 

0  , 

1  , 

4  , 

4  , 

2 

E 

-1 

01 

4 

02 

0 

,E 

-1 

4 

rcv_ack2 

rcv_data 

294 

300 

300 

[ 

4 

1  , 

1  . 

4  . 

0  , 

3 

E 

-1 

E 

-1 

02 

0 

.E 

-1 

4 

rcv_aclc2 

rcv_data 

308 

314 

314 

[ 

4 

2  , 

1  , 

4  , 

1  , 

4 

E 

-1 

E 

-1 

E 

-1 

,E 

-1 

4 

rcv_ack2 

3nd“ac)c 

324 

312 

283 

[ 

3 

1  . 

0  , 

3  , 

0  , 

3 

E 

-1 

E 

-1 

E 

-1 

.E 

-1 

4 

ccv_ackl 

snd_daCa 

snd_aclc 

295 

300 

281 

202 

( 

1 

1  , 

3  , 

1  , 

3  , 

1 

E 

-1 

E 

-1 

E 

-1 

,E 

-1 

-1 

snd~data 

snd~aclc 

214 

215 

215 

[ 

1 

0  . 

3  , 

1  . 

3  , 

1 

-1 

E 

-1 

E 

-1 

,E 

-1 

3 

rcv~ackO 

snd_daCa 

200 

232 

232 

: 

2 

0  . 

4  , 

2  , 

3  , 

1 

□  0 

3 

E 

-1 

E 

-1 

,E 

-1 

3 

rcv~ackl 

snd_daca 

rcv_data 

212 

248 

249 

248 

( 

3 

0  , 

0  , 

3  , 

3  , 

1 

00 

3 

01 

4 

E 

-1 

,E 

-1 

3  : 

rcv_ack2 

snd_data 

rcv_data 

227 

268 

269 

268 

t 

4 

0  , 

1  , 

4  , 

3  , 

1 

00 

3 

01 

4 

02 

0 

.E 

-1 

3  ] 

rcv_ack3 
rev  data 

242 

284 

284 

( 

4 

1  , 

1  , 

4  , 

4  , 

2 

E 

-1 

01 

4 

02 

0 

,E 

-1 

3  : 

rcv_ack3 

rcv_daca 

261 

301 

301 

[ 

4 

2  , 

1  , 

4  , 

0  , 

3 

E 

-1 

E 

-1 

02 

0 

,E 

-1 

3  ] 

rcv_ack3 
rev  data 

275 

315 

315 

[ 

4 

3  , 

1  , 

4  , 

1  , 

4 

E 

-1 

E 

-1 

E 

-1 

,E 

-1 

3  ; 

rcv_ack3 

snd~aek 

291 

312 

269 

( 

3 

1  , 

0  , 

3  , 

4  , 

2 

E 

-1 

01 

4 

E 

-1 

,E 

-1 

3  : 

rev_aek2 

snd^data 

rcv~data 

243 

284 

285 

285 

t 

3 

2  , 

0  , 

3  , 

0  , 

3 

E 

-1 

E 

-1 

E 

-1 

,E 

-1 

3  : 

rcv~aek2 

snd_data 

snd'ack 

262 

301 

281 

249 

( 

2 

1  , 

4  , 

2  , 

4  , 

2 

E 

-1 

E 

-1 

E 

-1 

.E 

-1 

3  ! 

rev~ackl 

snd~daca 

snd~ack 

228 

269 

247 

178 

( 

4 

0  , 

3  , 

1  , 

2  , 

4 

E 

-1 

E 

-1 

E 

-1 

,03 

2 

2  1 

rev“ackl 

rcv_data 

188 

189 

189 

( 

4 

1  , 

3  , 

1  , 

3  , 

1 

E 

-1 

E 

-1 

E 

-1 

,E 

-1 

2  ; 

rev'ackl 

snd~aek 

.202 

187 

103 

[ 

2 

1  , 

1  , 

3  , 

0  , 

2 

E 

-1 

01 

0 

E 

-1 

,E 

-1 

-1  : 

snd~data 

rev_data 

121 

122 

122 

1 

2 

2  , 

1  , 

3  , 

1  , 

3 

E 

-1 

E 

-1 

E 

-1 

,E 

-1 

-1  : 

snd~data 
snd  ack 

135 

136 

136 

( 

2 

0  . 

1  , 

3  , 

1  , 

3 

E 

-1 

E 

-1 

E 

-1 

,  E 

-1 

1  ; 

rev  aekO 
snd  data 

152 

153 

152 

1 

0 

0  , 

1  , 

3 

1  , 

3 

c 

^  1 

E 

-1 

E 

-1 

,  E 

- 1 

-1  : 

snd  data 

164 

164 

( 

1 

0  , 

2  , 

4  , 

1  , 

3 

E 

-I 

E 

-1 

02 

1 

,  E 

-1 

-1  ; 

snd  data 
rev  data 

179 

180 

179 

i 

2 

0  , 

3  , 

1  , 

1  , 

3 

£ 

-1 

E 

-1 

02 

1 

,  03 

2 

-1  i 

snd_data 
rev  data 

190 

191 

190 

■[ 

3 

0  , 

4  , 

2  , 

1  , 

3 

00 

3 

E 

02 

1 

,03 

2 

-i  i 

snd  data 
rev_data 

203 

204 

203 

[ 

4 

0  , 

0  , 

3  , 

1  , 

3 

00 

3 

01 

4 

02 

1 

,  03 

2 

-1  1 

rcv_data 

216 

216 

[ 

4 

1  , 

0  , 

3  , 

2  , 

4 

DO 

3 

01 

4 

E 

-1 

,03 

2 

-1  1 

rcv~data 

233 

233 

: 

4 

2  , 

0  , 

3  , 

3  , 

1 

DO 

3 

01 

4 

E 

-1 

,E 

-1 

-1  1 

rcv_data 

250 

250 

r 

4 

3  , 

0  , 

3  , 

4  , 

2 

£ 

-  ^ 

01 

4 

£ 

-1 

.  E 

-1 

-1  i 

rev  data 

270 

270 

i 

4 

4  , 

0  , 

3  , 

0  , 

3 

E 

-1 

£ 

- 1 

E 

-1 

,E 

-1 

-1  ; 

snd  ack 

286 

286 

i 

4 

0  , 

0  , 

3  , 

0  , 

3 

E 

- 1 

E 

- 1 

E 

-1 

,E 

-1 

0  ■ 

rcv_ackO 

292 

204 

I 

3 

‘  ' 

4  , 

2  , 

2  , 

4 

DO 

3 

- 1 

E 

-1 

,  03 

2 

-1  ; 

snd_data 
rev  data 

216 

217 

217 

( 

3 

2  , 

4  , 

2  , 

3  , 

1 

DO 

3 

E 

- 1 

E 

-1 

,E 

-1 

-1  ; 

snd  data 
rcv_data 

233 

234 

234 

1 

3 

3  , 

4  , 

2  , 

4  , 

2 

E 

-1 

E 

-1 

E 

-1 

,  E 

-1 

-1  : 

snd  data 
snd  ack 

250 

251 

251 

( 

3 

0  , 

4  , 

2  , 

4  , 

2 

E 

-1 

E 

-1 

E 

-1 

,E 

-1 

4  1 

rev  ackO 
snd  data 

263 

271 

271 

( 

4 

0  , 

0  , 

3  , 

4  , 

2 

E 

“  A 

D1 

4 

E 

-1 

,  E 

- 1 

4  ; 

rcv_ackl 

rcv_data 

277 

287 

287 

( 

4 

1  , 

0  , 

3  , 

0  , 

3 

E 

-1 

E 

-1 

E 

-1 

,E 

-1 

4  : 

rev  ackl 
snd_ack 

295 

286 

191 

( 

2 

1  , 

3  , 

1  , 

2  , 

4 

E 

-1 

E 

-1 

E 

-1 

,  03 

2 

-1  : 

snd  data 

204 

rev  data  205 


219 


205 
218 

235 

252 

272 
288 

253 

180 

192 

206 

219 

236 

254 

273 
289 

237 

255 

220 

153 

165 
181 

193 

166 

88 

104 

123 

137 

154 
167 

182 

194 
207 
221 

238 

256 
183 

195 


(  2  , 
:  2  , 
(  3  , 

:  4  , 
[  4  , 
[  4  . 
[  3  , 

(  1  , 
[  1  , 
[  2  , 

[  3  . 

[  4  , 
(  4  . 
(  4  , 
[  4  , 
(  3  , 

[  3  , 

(  2  , 

(  3  , 

(  4  , 
(  4  , 
(  4  , 
(  3  , 

(  1  , 

(  1  , 

(  0  , 
(  1  , 

[  2  , 

(  3  , 

1  4  , 
[  4  , 
(  4  , 
(  4  , 
(  4  , 
(  4  , 
(  3  , 

!  3  , 


2  .  3  ,  1  .  3  ,  1  , 

0  .  3  ,  1  .  3  .  1  , 

0  ,  4  ,  2  ,  3  ,  1  , 

0  .  0  ,  3  ,  3  ,  1  , 

1  .  0  ,  3  ,  4  ,  2  , 

2  ,  0  ,  3  ,  0  .  3  . 

1  ,  4  .  2  ,  4  .  2  , 

1  .  2  .  4  ,  2  ,  4  . 

0  .  2  ,  4  ,  2  ,  4  , 

0  .  3  ,  1  ,  2  ,  4  . 

0  .  4  ,  2  ,  2  ,  4  , 

0  ,  0  ,  3  ,  2  .  4  , 

1  .  0  .  3  ,  3  ,  1  . 

2  .  0  ,  3  ,  4  ,  2  , 

3  ,  0  ,  3  ,  0  ,  3  , 

1  ,  4  ,  2  ,  3  ,  1  , 

2  ,  4  ,  2  ,  4  ,  2  , 

1  ,  3  ,  1  ,  3  ,  1  , 

0  ,  2  ,  4  ,  1  ,  3  , 

0  ,  3  ,  1  ,  1  ,  3  , 

1  ,  3  ,  1  ,  2  ,  4  , 

2  ,  3  ,  1  ,  3  ,  1  , 

1  ,  2  ,  4  ,  2  ,  4  , 

1  ,  0  ,  2  ,  0  ,  2  , 

0  ,  0  ,  2  ,  0  ,  2  , 

0  ,  0  ,  2  ,  0  ,  2  , 

0  ,  1  ,  3  ,  a  ,  2  , 

0  ,  2  ,  4  ,  0  ,  2  , 

0  ,  3  ,  1  ,  0  ,  2  , 

0  ,  4  ,  2  ,  0  ,  2  , 

1  ,  4  ,  2  ,  1  ,  3  , 

2  ,  4  ,  2  ,  2  ,  4  , 

3  ,  4  ,  2  ,  3  ,  1  , 

4  ,  4  ,  2  ,  4  ,  2  , 

0  ,  4  ,  2  ,  4  ,  2  , 

1  .  3  ,  1  ,  1  ,  3  , 

2  3  ,  1  ,  2  ,  4  , 


E 

-1 

t 

E 

-1 

0 

E 

-1 

-1 

0 

-1  ’ 

1  snd_data 

217 

snd_ack 

218 

E 

-1 

» 

E 

-1 

0 

E 

-1 

,E 

-1 

0 

3  ; 

1  rcv_aclcO 

200 

snd_data 

235 

DO 

3 

» 

E 

-1 

0 

E 

-1 

,E 

-1 

0 

3  ; 

1  rcv_ackl 

212 

snd_daCa 

252 

Ecv_data 

253 

DO 

3 

» 

D1 

4 

0 

E 

-1 

rE 

-1 

0 

3  ; 

1  rcv_aclc2 

227 

rcv~data 

272 

E 

-1 

* 

D1 

4 

0 

E 

-1 

,E 

-1 

0 

3  ; 

1  rcv~aclc2 

243 

rev^data 

288 

E 

-1 

0 

E 

-1 

0 

E 

-1 

,E 

-1 

0 

3  ; 

1  rcv_ack2 

262 

snd_aclc 

286 

E 

-1 

0 

E 

-1 

0 

E 

-1 

.E 

-1 

0 

3  ; 

1  rcv_ackl 

228 

snd_data 

272 

snd~aclc 

251 

E 

-1 

0 

E 

-1 

0 

E 

-1 

.E 

-1 

0 

-1  : 

1  snd_data 

191 

snd~ack 

192 

E 

-1 

t 

E 

-1 

0 

E 

-1 

,E 

-1 

0 

2  ; 

1  rcv_ac)cO 

177 

snd_daCa 

206 

E 

-1 

0 

E 

-1 

0 

E 

-1 

.D3 

2 

0 

2  1 

1  rcv_ac)cl 

188 

snd_daCa 

219 

rcv_data 

220 

DO 

3 

0 

E 

-1 

0 

E 

-1 

,D3 

2 

0 

2  ] 

1  rcv_ack2 

201 

snd_daca 

236 

rcv_daCa 

237 

DO 

3 

0 

D1 

4 

E 

-1 

,03 

2 

t 

2  ] 

1  rcv_ack3 

213 

rcv_data 

254 

DO 

3 

0 

01 

4 

0 

E 

-1 

,E 

-1 

0 

2  1 

1  rcv_ack3 

230 

rcv_data 

273 

E 

-1 

0 

D1 

4 

0 

E 

-1 

,E 

-1 

0 

2  1 

1  rcv_ack3 

246 

rcv_data 

289 

E 

-1 

0 

E 

-1 

0 

E 

-1 

,E 

-1 

0 

2  ] 

i  rcv~ack3 

266 

snd^ack 

286 

DO 

3 

0 

E 

-1 

0 

£ 

-1 

,E 

-1 

0 

2  ] 

1  tcv_ack2 

214 

snd~daCa 

254 

rcv~data 

255 

E 

-1 

0 

E 

-1 

0 

E 

-1 

,E 

-1 

0 

2  1 

1  rcv~ack2 

231 

snd_daca 

273 

snd~ack 

251 

E 

-1 

0 

E 

-1 

E 

-1 

,E 

-1 

0 

2  : 

1  rcv_ackl 

202 

snd^data 

237 

snd~ack 

218 

E 

-1 

0 

E 

-1 

0 

D2 

1 

,E 

-1 

0 

1  i 

1  rcv'ackl 

164 

snd~data 

165 

rcv~data 

166 

E 

-1 

0 

E 

-1 

0 

D2 

1 

,  03 

2 

0 

1  i 

rcv~ack2 

179 

rcv“data 

181 

E 

-1 

0 

E 

-1 

0 

E 

-1 

,D3 

2 

0 

1  1 

rcv~ack2 

191 

rev  data 

193 

E 

-1 

0 

E 

-1 

0 

E 

-1 

,  E 

-1 

0 

1  1 

rev  aek2 

205 

snd  aek 

187 

E 

-1 

0 

E 

-1 

E 

-1 

,  E 

-  T_ 

0 

1  ] 

rev  aekl 

180 

snd_data 

181 

snd_aek 

163 

E 

-1 

E 

-1 

E 

-1 

,  E 

-1 

-1  1 

snd_daca 

103 

3nd~aek 

104 

E 

-1 

E 

-1 

E 

-1 

,E 

-1 

0  1 

rev_aekO 

123 

snd_daca 

124 

£ 

-1 

E  ' 

-1 

E 

-1 

,E 

-1 

-1  ] 

snd_daCa 

137 

E 

-1 

D1 

0 

E 

-1 

,  E 

-1 

0 

-1  1 

snd  data 

154 

rev  data 

155 

E 

-1 

D1 

0 

02 

1 

,E 

-1 

0 

-1  1 

snd  data 

167 

rev_data 

168 

E 

-1 

D1 

0 

02 

1 

,  03 

2 

0 

-1  1 

snd_data 

182 

rev_data 

183 

DO 

3 

01 

0 

02 

1 

,D3 

2 

0 

-1  1 

rev_data 

194 

DO 

3 

E 

-1 

02 

1 

,03 

2 

0 

-1  1 

rev  data 

207 

DO 

3 

E 

-1 

E 

-1 

,  03 

2 

0 

-1  1 

rev_data 

221 

DO 

3 

E 

-1 

E 

-1 

,  E 

-1 

0 

-1  1 

rev  data 

238 

E 

- 1 

E 

-1 

r 

-1 

,E 

-1 

0 

’ 

snd  aek 

256 

r 

*  1 

E 

-1 

£ 

-1 

0  s 

-1 

0 

4  i 

rev_aekO 

263 

E 

-1 

E 

-1 

02 

1 

,  D3 

2 

-1  1 

snd_data 

194 

rev_data 

195 

E 

-1 

f 

E 

-1 

0 

E 

-1 

,  03 

2 

, 

-1  1 

snd  data 

207 

rev  data  208 


220 


208  [  3  ,  3  ,  3  ,  1  ,  3  ,  1  ,  E  -1  ,  E  -1  .  E  -1  ,E  -1,-1]  3nd_data  221 

snd_acic  222 

222  [  3  .  0  ,  3  ,  1  ,  3  ,  1  ,  E  -1  .  E  -1  ,  E  -1  ,E  -1  ,  3  ]  rcv_aclc0  200 

snd  data  239 

239  (  4  ,  0  ,  4  ,  2  ,  3  ,  1  ,  00  3  ,  E  -1  .  E  -1  ,E  -1  ,  3  1  rcv“ac)cl  212 

rcv_daca  257 

257  1  4  .  1  .  4  ,  2  ,  4  ,  2  ,  E  -1  ,  E  -1  ,  E  -1  ,E  -1  ,  3  J  rcv_ac)cl  228 

snd  acic  256 

168  (  2  ,  1  ,  2  ,  4  ,  1  ,  3  ,  E  -1  .  E  -1  ,  02  1  ,E  -1,-1]  snd'data  183 

rcv_data  184 

184  (  2  ,  2  .  2  ,  4  ,  2  ,  4  .  E  -1  ,  E  -1  ,  E  -1  ,E  -1,-1]  snd_data  195 

snd  ack  196 

196  I  2  ,  0  .  2  ,  4  ,  2  ,  4  .  E  -1  ,  E  -1  ,  E  -1  ,E  -1  ,  2  ]  rcv_ack0  177 

snd  data  209 

209  [  3  ,  0  ,  3  ,  1  ,  2  ,  4  ,  E  -1  .  E  -1  ,  E  -1  ,03  2  ,  2  ]  ccv_ackl  188 

snd_data  223 
rcv_data  224 

223  [  4  ,  0  ,  4  ,  2  ,  2  ,  4  ,  DO  3  ,  E  -1  ,  E  -1  ,03  2  ,  2  )  rcv_ack2  201 

rcv~data  240 

240  (  4  ,  1  ,  4  ,  2  ,  3  ,  1  ,  00  3  ,  E  -1  ,  E  -1  ,E  -1  ,  2  ]  rcv_ack2  214 

rev  data  258 

258  (  4  ,  2  ,  4  .  2  ,  4  ,  2  ,  E  -1  ,  E  -1  ,  E  -1  ,E  -1  ,  2  ]  rcv“ack2  231 

snd_ack  256 

224  (  3  ,  1  ,  3  ,  1  ,  3  ,  1  ,  E  -1  ,  E  -1  ,  E  -1  ,E  -1  ,  2  ]  rcv_ackl  202 

snd_data  240 
snd_ack  222 

155  (  1  ,  1  ,  1  ,  3  ,  1  ,  3  ,  E  -1  ,  E  -1  ,  E  -1  ,E  -1,-1]  3nd_data  168 

snd~ack  169 

169  [  1  ,  0  ,  1  ,  3  ,  1  ,  3  ,  E  -1  ,  E  -1  ,  E  -1  ,E  -1  ,  1  1  rcv_ack0  152 

snd_data  185 

185  1  2  .  0  .  2  ,  4  ,  1  ,  3  ,  E  -1  ,  E  -1  ,  02  1  ,E  -1  ,  1  ]  rcv_ackl  164 

.  snd_data  197 

rcv~data  198 

197  (  3  ,  0  ,  3  ,  1  ,  1  ,  3  ,  E  -1  ,  E  -1  ,  02  1  ,03  2  ,  1  ]  rcv~ack2  179 

snd'data  210 
rcv~data  211 

210  (  4  ,  0  ,  4  ,  2  ,  1  ,  3  ,  DO  3  ,  E  -1  ,  02  1  , 03  2  ,  1  1  rcv~ack3  190 

rev  data  225 

225  (  4  ,  1  ,  4  ,  2  ,  2  ,  4  ,  00  3  ,  E  -1  ,  E  -1  ,03  2  ,  1  )  rev"aek3  204 

rcv~data  241 

241  (  4  ,  2  ,  4  ,  2  ,  3  ,  1  ,  DO  3  ,  E  -1  ,  E  -1  ,E  -1  ,  1  ]  rcv;;aek3  217 

rev  data  259 

259  (  4  ,  3  ,  4  ,  2  ,  4  ,  2  ,  E  -1  ,  E  -1  ,  E  -1  ,E  -1  ,  1  1  rev2aek3  234 

snd  aek  256 

211  (  3  ,  1  ,  3  ,  1  ,  2  ,  4  ,  E  -1  ,  E  -1  ,  E  -1  ,03  2  ,  1  )  rcv~ack2  191 

snd~data  225 
rev  data  226 

226  :  3  ,  2  ,  3  ,  1  ,  3  ,  1  ,  E  -1  ,  E  -1  ,  E  -1  ,E  -1  ,  1  ]  rcv_aek2  205 

snd_data  241 
snd_aek  222 

198  (  2  ,  1  ,  2  ,  4  ,  2  ,  4  ,  E  -1  ,  E  -1  ,  E  -1  ,E  -1  ,  1  ]  rev_aekl  180 

snd_data  211 
snd_ack  196 

124  :  2  ,  0  ,  1  ,  3  ,  0  ,  2  ,  E  -1  ,  01  0  ,  E  -1  ,E  -1  ,  0  ]  rev_aekl  137 

snd_data  138 
rcv_data  139 

138  ;  3  ,  0  ,  2  ,  4  ,  0  ,  2  ,  E  -1  ,  01  0  ,  02  1  ,E  -1  ,  0  1  rev_aek2  154 

snd_data  156 
rev_data  157 

156  [  4  ,  0  ,  3  ,  1  ,  0  ,  2  ,  E  -1  ,  01  0  ,  02  1  , 03  2  ,  0  ]  rcv_aek3  167 

rcv_data  170 

170  [  4  ,  1  ,  3  ,  1  ,  1  ,  3  ,  E  -1  ,  E  -1  ,  02  1  ,03  2  ,  0  ]  rcv_aek3  183 

rcv_data  186 

186  [  4  ,  2  ,  3  ,  1  ,  2  ,  4  ,  E  -1  ,  E  -1  ,  E  -1  ,03  2  ,  0  J  rev_ack3  195 

rev_data  199 

199  [  4  ,  3  ,  3  ,  1  ,  3  ,  1  ,  E  -1  ,  E  -1  ,  E  -1  ,E  -1  ,  0  ]  rev_ack3  208 

snd_aek  187 

157  [  3  ,  1  ,  2  ,  4  ,  1  ,  3  ,  E  -1  ,  E  -1  ,  02  1  ,E  -1  ,  0  ]  rev_aek2  168 

snd_data  170 
rcv_data  171 

171  [  3  ,  2  ,  2  ,  4  ,  2  ,  4  ,  E  -1  ,  E  -1  ,  £  -1  ,E'  -1  ,  0  ]  rcv_ack2  184 

snddata  186 
snd_ack  163 

139  [2,  1,  1,3,1,  3, E  -i,E  -1,E  -1,E  -1,  0]  rev_ackl  155 

snd_data  157 
snd  ack  136 
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8  (  3  ,  1  .  3  ,  4  ,  1  ,  2  ,  E  -1  .  D1 

13  (3, 2, 3, 4, 2, 3, E  -l.E 

19  [3, 3, 3, 4, 3, 4, E  -l.E 

27  (3, 0.3. 4. 3, 4, E  -l.E 

37  [0. 0.3. 4. 3, 4. E  -l.E 

48  (  1  .  0  .  4  .  1  .  3  .  4  ,  E  -l.E 

61  (  2  .  0  .  0  .  2  .  3  .  4  .  DO  4  .  E 

73  (  3  .  0  .  1  .  3  .  3  .  4  .  DO  4  .  01 

89  (  4  .  0  .  2  .  4  .  3  .  4  .  DO  4  .  D1 

105  [  4  .  1  .  2  .  4  .  4  .  1  .  DO  4  ,  D1 

125  (  4  .  2  .  2  .  4  .  0  .  2  .  E  -1  .  D1 

140  (  4  .  3  .  2  .  4  .  1  .  3  ,  E  -l.E 

158  [  4  .  4  .  2  .  4  .  2  .  4  .  E  -l.E 

172  (  4  .  0  .  2  .  4  .  2  .  4  .  E  -l.E 

90  (  3  .  1  .  1  .  3  .  4  .  1  .  DO  4  .  D1 

106  (  3  .  2  .  1  .  3  .  0  .  2  .  E  -1  .  D1 

126  [  3  .  3  .  1  .  3  .  1  ,  3  .  E  -l.E 

141  [  3  .  0  ,  1  .  3  ,  1  .  3  .  E  -l.E 

159  (  4  .  0  .  2  .  4  .  1  .  3  .  E  -l.E 

173  (  4  .  1  .  2  .  4  ,  2  .  4  ,  E  -l.E 

74  (  2  .  1  .  0  .  2  .  4  .  1  .  DO  4  ,  E 

91  (2. 2. 0.2.0. 2. E  -l.E 

107  t  2  .  0  .  0  .  2  .  0  ,  2  .  E  -l.E 

127  (  3  ,  0  .  1  .  3  .  0  ,  2  .  E  -1  ,  D1 

142  (  4  .  0  .  2  .  4  ,  0  ,  2  ,  E  -1  ,  D1 

160  (  4  .  1  .  2  ,  4  .  1  ,  3  .  E  -l.E 

174  (  4  ,  2  .  2  ,  4  ,  2  ,  4  ,  E  -l.E 

143  (  3  ,  1  .  1  .  3  .  1  .  3  ,  E  -l.E 

62  (  1  ,  1  ,  4  ,  1  ,  4  ,  1  ,  E  -l.E 

75  (  1  .  0  .  4  ,  1  ,  4  ,  1  ,  £  -l.E 

92  12, 0,0, 2, 4,1,  DO  4,E 

108  (  3  ,  0  ,  1  ,  3  ,  4  ,  1  ,  DO  4  ,  D1 

128  [  4  ,  0  ,  2  ,  4  ,  4  ,  ’  1  ,  DO  4  ,  D1 

144  (  4  ,  1  ,  2  ,  4  ,  0  ,  2  ,  E  -1  ,  01 

161  I  4  ,  2  ,  2  ,  4  ,  1  ,  3  ,  E  -l.E 

175  (  4  ,  3  ,  2  ,  4  ,  2  ,  4  ,  E  -l.E 

129  [  3  ,  1  ,  1  ,  3  ,  0  ,  2  ,  E  -1  ,  D1 

145  :  3  ,  2  ,  1  ,  3  ,  1  ,  3  ,  £  -l.E 

109  !  2  ,  1  ,  0  ,  2  ,  0  ,  2  ,  E  -l.E 
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APPENDIX  I  (SCM)  SELECTIVE  REPEAT,  W=1 


INPUT 


scact 
machine  1 
scace  0 

crans  snd_datal  1 
sCace  1 

crans  rcv_ac)cl  2 
sCaCe  2 

crans  adv_winl  0 
machine  2 
scace  0 

crans  rcv_dacal  1 
sCaCe  1 

crans  snd_aclcl  0 
inicial_scace  0  0 
finish 
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VARIABLE  DEFINITIONS 


package  definitions  Is 

type  scm_transition_type  is  {snd_datal,  rcv_datal,  snd  acltl, 
~  rcv_ackl,  adv_winl,  unused) ; 

type  buf/»r_type  is  (dl,e,al); 
type  boolean_type  is  (t, f) ; 

type  buffer_array_type  is  array (1..1)  of  buffer_type; 
type  boolean_array_type  is  array (1..1)  of  boolean_type; 

type  machinel_atate_type  is 
record 

state  number  :  natural  :«  0; 

out  buffer  :  buf fer_array_typo  (others»>dl) 

ack”rec  :  boolean_array_type  (others»>f) ; 

current  i  integer  range  l,.l  :■  1; 

end  record; 

type  tnachine2_atata_type  is 
record 

state  number  :  natural  0; 

in  buffer  :  buf fer_array_type  (others«>e) ; 

pkt"  rec  :  boolean’_array_type  (others“>f)  ; 

current  :  integer  range  1..1  1; 

end  record; 

type  global_variable_type  is 
record  ” 

DATA  :  buffer_type  e; 

end  record; 

end  definitions; 
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PREDICATE-ACTION 


separace  (main) 

function  Analyze_Predicaces_Machinel ( local  :  machinel_stace  type; 

GLOBAL:  qlcbal_variabre_t:ype)  return  transition 

staclc_paclcage. stack  is 
*  begin 

MakaEnpty (transition_stack) ; 
if  ( local .out_bufferTl)  /”  E)  then 
Push  (transition  stack,  snd  datal)  ; 
end  if;  ~ 

if  ( (local. ack  rec(l}-f)  and  GLOBAL. OAT A»A1)  then 
Push  (transTtion  stack,  rev  ackl); 
end  if;  ~ 

Push (transition_stack. adv_winl) ; 
return  transitlQn_stack; 
end  Analyze_Predicates_Machinel; 


separate  (main) 

function  Analyze_Predlcates_Machine2 (local  :  machine2_state_type; 

~  GLOBAL:  global_variable_type)  return  transition_- 

stack_package. stack  is  ~ 

begin” 

MakeEmpty (transition  stack); 

if  ( (GLOBAL. DATA  -  oT)  and  ( local . pkt_rec ( 1) -f) )  then 
Push (transition_stack. rcv_datai) ; 
end  if; 

if  (local. pkt  rec(l)-t)  then 

Push (transTtlon_stack. snd_ackl) ; 
end  if; 

return  transition_stack; 

end  Analyze_Predicates_Machine2;  —  this  returned  value  is  then  chec)ted  against  the 
machine  arrays 

--  to  determine  if  indeed  this  transition  can  be 

taken 


sepa\rate  (main) 

procedure  Act  ion ( in_system_state  :  in  out  Gstate_record_type; 

~in_transir ion  :  in  out  scm2transition_type; 
out_system_state  :  in  out  Gstate_record_type)  is 

temp  :  integer  :■  0; 

begin 

case  ( in_transition)  is 
when ”( snd_datal)  •> 

out_system_state .GLOBAL_VARIABLES.OATA  :• 

in_sy3tem_state .machinel_state .out_buf  fer ( 1) ; 
when  (rcv^ackl)  "»>  ~ 

out_system_state . machine Istate .ack_rec ( 1)  t; 

out_sy3tem_state .GLCBALVAR TABLES . DATA  :»  e; 
out_system_'state  . machinel_state  .current  1; 

when  (rcv_datal)  -> 

out_system_state . mach ine2  sta te . in_Du f f er ( 1)  := 
in_system_state . G LOB AL_ VAR  TABLES . DATA; 
out_system_state .GLOBAL_VARTABLES . DATA  e; 

out_system_state .mach ine2_state .pkt_rec ( 1)  t; 

when  (snd_ackl)  -> 

out_system_state .GL0BAL_VARTA8LES . DATA  :»  al; 
out_system_state .machine2  state .pkt _rec ( 1 )  f; 

out_system_3tate  .macn  ine2^_state  .  in_buf  fer  (1 )  e; 
when  (adv_winl)  -> 

out_system_state .ma¬ 
ch  inel_3tate.  ack_rec ( i n_system_ state. mach inelstate. current)  f; 

~  when  oShers  -J” 

put_line ("There  is  an  error  in  the  Action  procedure"); 
end  case; 
end  Action; 
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OUTPUT  FORMAT 


s«p«rac«  (main) 

procadur*  ouCput_Gtuple  (cuple  :  in  out  Gstace  cecord_l:ype)  is 
bagin  ~ 

put  ('*  (*  i  intagar' image  (tuple .machinel_scate . stace_number)  )  ; 

put(*  (  integer' image (tuple .machine2_state . stace_number) ) ; 
put(’‘ 

put (tuple. machinal_state. out_buffer (1) ,  width  ->  1); 
put  (*  ,  •)  ; 

put  (tuple. machinal_state.ac)c_rec(l)  ,width>>2)  ; 
put (•  ,  *)  ; 

put (tuple. machlne2_state.in_buf fee (1) ,  width  ->  1); 
put  (•  ,  •)  ; 

put  (tuple .machine2  state. p)ct  rec (1) ,  wldth«>2)  ; 
putC  .  •); 

put (tuple. GLOBAL_VARIABLES. DATA,  width  ->2) ; 
putC  ]•); 
end  output_Gtuple; 

separata  (main) 

procedure  output_Gtuple_to_file (tuple  :  in  out  Gstate_record_type; 

counter  :  in  out  integer)  is 

begin 

put (reach, counter) ; 

put(reach,'  (*  t  integer' image (tuple .machinel_state . state_number) ) ; 
put(reach,'  , '  t  integer' image (tuple .machine2_state . state_number) ) ; 
put (reach,'  ,  “) ;  ~ 

put  (reach,  tuple. ma'chinel_state .out_buffer  (1) ,  width  ->  1)  ; 
put (reach,'  ,  *) ;  ~ 

put  (reach,  tuple .machinel_state  .ac)c_rec  (1) ,  width->2) ; 
put (reach,'  ,  *) ;  ~  ~ 

put (reach, tuple. machine2_state . in_buffer (1) ,  width  »>  1); 
put  (reach,'  ,  '*); 

put  (reach,  tuple  .machine2_st ate .  pltt_rec  (1) ,  width“>2) ; 
put (reach,'  ,  *); 

put(reach,tuple.GLOBAL_VAJRrABLES.DATA,  width  ->2); 
put (reach,'  ]'); 
new_line (reach) ; 
end  output_Gtuple_to_f i le; 

separate  (main) 

procedure  output_Gstate_node  (Gstate  pointer  :  in  out  Glin)t_type; 

~  Error_flag  :  in  out  boolean)  is 

begin 

output_line_count  :«  output  line_count  ♦  1; 
if  ( (output~line_count  mod  TO)  ■  0)  then 
scroll_pause; 
end  if; 

set_col (Gcolumn_set ) ; 

put (Gscace_pointer . system_state_number,  width  •>  3) ; 
output_Gtuple (Gstate  pointer .Gtuple) ; 

if  (  (Gstate_pointer  .  Tinkl  .G1  in)c  •  null)  and  then  (Gstate_po  inter  .  1  inli2  .G1  inli  =  null) 
and  then 

(Gstate_pointer  .  1  ink3  .G 1  inli  •  null)  and  then  (Gstate_pointer  .  1  ink'I  .G1  in)t  -  null)) 

then 

Error_flaq  :»  true; 
else  ~ 

Error_flag  false; 
end  if; 

and  output_Gstate_node; 
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OUTPUT 


REACHABILITY  ANALYSIS  of  :  *«l_r«p_wl 
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232 


APPENDIX  J  (SCM)  SELECTIVE  REPEAT,  W=2 


INPUT  (FSM) 

start 
machine  1 
state  0 

trans  snd_datal  1 
state  1 

trans  rcv_acJcl  2 
state  2 

trans  adv_winl  0 
machine  2 
state  0 

trans  rcv_datal  1 
state  1 

trans  snd_acltl  0 
initial_state  0  0 
finish 
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VARIABLE  DEHNITIONS 


package  definitions  is 

type  scm_transition_type  is  (snd_data,  rcv_data, 

snd^ack.  rcv_ack, 
adv^winl,  unused) ; 

type  buffor_type  is  (dl, d2, e, al, a2) ; 
type  boolean_type  is  (t, f ) ; 

subtype  ack  buffer_type  is  buffer_type  range  e..a2; 
subtype  data_buf fer_type  is  buffet_type  range  dl..e; 

type  ack_array_type  is  array(1..2)  of  ack_buf fer_type; 
type  data_array_type  is  array (1.. 2)  of  data_buf fet_type; 

type  boolean_array_type  is  array{1..2)  of  boolean_type; 


type  machinel  state  type 

is 

record 

stata_nufflber 

natural 

Q; 

out_buf fer 

:  data_array_type 

(dl.d2)  ; 

ack_rec 

:  boolean_array_type 

(others->f) 

current 

:  integer”range~l. .2 

1; 

hold 

:  boolean  type 

f; 

end  record; 

type  machine2  state  type 

is 

record 

state  number 

natural 

:  ■ 

0; 

in_bu'?fer  : 

data_array_type 

:» 

(others«>e) 

pkt"  rec  : 

end  record; 

boolean_atray_type 

•  • 

(others“>f ) 

type  global_var iable_type  is 


record  ~  • 

(others»>e) ; 

DATA 

:  data_array_type 

CONTROL 
end  record; 

:  ack_array_t’ype 

:»  (others»>e) ; 

end  definitions; 
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PREDICATE-ACTION 


s 


separate  (main) 

function  Analyze_Pradicates_Machinel ( local  :  machinel_stato  type; 

GLOBAL:  global_'7ariabre_type)  return  transit ion_- 

staclc_paclcage .  stack  is 
begin 

MakeEmpty (transition  stack); 

if  (( (local. hold  -  fl  and  (local. out  buffer(l)  /-  E)  and  (GLOBAL.DATA(l) -E) )  or 
((local. hold  -  f)  and  (local  .out^uffor  <2)  /-  E)  and  (GLOBAL. DATA(2) -E)  )  )  then 
Push (tran3ition_stack, snd_data) ; 
end  if; 

if  (( (local. ack_rec(l)-f)  and  (GLOBAL. CONTROL(l)  -  AD)  or 

( (local.ack_rec(2)-f)  and  (GLOBAL. CONTROL (2)  -A2)))  then 
Push  (transit’ion_stack,  rcv_ack)  ; 
end  if;  ~ 

Push (tran3ition_stack, adv_winl) ; 
return  transition_stack;  ~ 
end  Analyze_Predicates_Machinel; 

separate  (main) 

function  Analyze_Predicatas_Machine2 ( local  :  machlne2_state  type; 

“  GLOBAL:  global_varial3le_type)  return  transition_- 

stack_package . stack  is 
begin” 

MakeEmpty (transition_stack) ; 

if  ( ( (GLOBAL.DATA(l)  -  01)  and  (GLOBAL. DATA (2)  -  E)  and  ( local . pkt_rec ( 1 ) -f) )  or 
( (GLOBAL. DATA (1)  «  E)  and  (GLOBAL.OATA (2)  -  02)  and  ( local . pkt_rec (2 ) -f ) )  or 
( (GLOBAL. DATA (1)  -  01)  and  (GLOBAL.OATA (2)  •  02)  and  ( local . pkt_rec ( 1 ) -t )  and 
( local .pkt_rec (2) -f ) )  or 

( (GLOBAL.OATA (1)  -  01)  and  (GLOBAL.OATA (2)  -  02)  and  ( local .pkt_rec ( 1) -f)  and 
(local .pkt_rec (2) "f ) ) )  then 
Push (transit'ion_stack,  rcv_data)  ; 
end  if;  ~ 

if  (( (GLOBAL. CONTROL(l) -E)  and  (local-pkt  rec(l)-t))  or 

( (GL0BAL.C0NTR0L(2) -E)  and  (local .pkt“rec (2) -t) ) )  then 
Push (transition_stack, snd_ack) ; 
end  if; 

return  transition_stack; 

end  Analyze_Predicates_Machine2;  —  this  returned  value  is  then  checked  against  the 
machine  arrays 

--  to  determine  if  indeed  this  transition  can  be 

taken 

separate  (main) 

procedure  Act  ion ( in_sy3tem_state  :  in  out  Gstate_record_type; 

in_tran3it ion  ;  in  out  scm”transition_cype; 
out_system_3tate  :  in  out  Gstatej^record_type)  is 


temp  :  integer  0; 

begin 

case  ( in_t ransit ion)  is 
when~(snd_data)  ■> 

out_3ystem_state .GLOBALVAR TABLES. - 
DATA ( in_system_3tate .machine l_3t ate . current)  : = 

~  in_system  state .machinelstate. ouc_- 

buf fer ( in_3ystem_state . machine l_state. current ) ; 

~  out_3y3tem_state .machinel  state .cur rent  in_system_state . machinel_state . - 

current ; 

begin 

case  (  in_sy3tem_3t at e  .  nach me l_3tate  . current )  is 
1  when  1  «> 

out_system_3tate .machinel_state .current  :•  2; 
when  2 

--out_3yscem_3tate . machinel_state .current  1; 
out_system_3tate.machinel_state.hold  :»  t; 
when  others  «> 

,  put_line ("error  in  the  action  procedure"); 

end  case; 
end; 

when  (rcv_aclr)  =>> 

if (in_system_state.GLOBAL_VARIABLES.CONTROL{l) =A1)  then 
out_system_state .mach inel_state . ack_rec ( 1)  t; 

out_system_state .GLOBAL_VARIABLES .CONTROL (1 )  :»  e; 
out_sy3tem_state .machinelstate -current  :•  1; 
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else 

if  (ln_system_3Cate.GL0BAL_VARIAaLES.C0NTR0L(2) -A2)  then 
out_system_staCe.machinel_scate.aclc  rec(2)  :•  C; 
out_system_scate.GLOBAl,_VARIABLES. CONTROL  (2)  e; 

•<ystem~state  .machine^l_stace  .  current  :«  2; 
end  ~ 

end  if; 

when  (rev  data)  -> 

if  (in_sy3Cem_state. GLOBAL  VARIABLES. DATA (1)  -  Dl)  then 
out_sysCem  state .machine?  state. in_buffer (1) 
in_system_stace .GLOBAL'vARIABLES . DATA ( 1) ; 
ouC_system_3tate.GL0BAL_VARIAELES.DATA(l)  e; 
out_system_state.machine2_state.p)ct_rec(l)  t; 
else  ~ 

if  (ln_syscem_state. GLOBAL  VAR TABLES . DAT A ( 2 )  -  D2)  then 
out_3ystera_state. machine?  state . in_buf fer (2) 
in_system_scate.GL0BAL_VARIABLES.DATA(2) ; 
out_system_state .GLOBAL_VARIABLES.DATA (2)  e; 
out~sysCem~atate  .machire2_stace  .plct_cec  (2)  C; 
end  if;  ~ 

end  if; 

when  (3nd_ac)c)  -> 

if  (in~system_3tate.machine2_stace.pkt_rec\l) -t)  then 
Out_system_state.GL0aAL_VARIAaLES .CONTROL (1)  al; 

out_system_state  .machine2_state  .plct_rec  ( 1)  f; 

out_3ystem_state .machine2_stace. in_buf fer (1)  e; 

else  ""  ~  ~  ~ 

if  (in  system  state .machine2  state .pkt_rec (2) -t )  Chen 

"out_system_state.GLOBAL_VARIABLES. CONTROL (2)  a2; 

out_system~state.machine2_sCate.pkC  rec(2)  :»  f; 
out~3yatem~state.machine22sCate. in_Buffer (2)  e; 

end  if;  ~ 

end  if; 

when  (adv_winl)  »> 

if  ( ( ln_syscem_state .machinel_state .ack_rec ( 1) »C)  and 
( in~sy stem's Cate .machine Instate .ack~rec (2) »f )  and 
(in~system~state.machinel~stace.hol3  •  t)  and 
(in'system  state .machinel~state .current  •  1)  and 
(in~syscem~state. GLOBAL  VARIABLES .DATA ( 1)  -  B)  and 
(in~system~state.GLOBAL2vARIABLES.DATA(2)  -  D2))  then 
out^syatemlstate .machinel_state .ack_rec (1)  :«f ; 
out^syatsm'staCe.machinel^state .ack~rec(2)  :»f; 
out ~sy St em~st ate .machine l~st ate .ho l3  :»f; 
out'syst em~st ate .machine l~3t ace .current  :«2; 
ouc~system~state. GLOBAL  VARIABLES. DATA (1)  Dl; 

out2system~sCaCe.GLOBAL2VARIASLES.DATA(2)  E; 

elsif 

( ( in_syscem_scate .machine l_3tate . ack_rec (1) «t )  and 
(in_system_state.machinel_state.ack  rec(2)»f)  and 
(in_sy3tem_stace.machinel_stace.hol3  -  t)  and 
( in~3ystem_stace . machinel_scace .current  •  1)  and 
( in_system_scace .machine2_3Cace . in_buf fer ( 1)  •  E)  and 
(  in_3yscem_state  . mach ine2_state'.  in_buf  fer  (2)  =  D2)  and 
(in2syscem_state .machine2_scate.pkc_rec (1)  -  f)  and 
(  in_sy3tem_state  .machine2_stace  .  pkc_rec  (2)  ■=  t))  Chen 
out_sy3tem_state .mach ine l_state . ack_rec (1)  : 'f ; 

out_sy3tem_state .machine  Is tate . ack'rec (2)  : -f ; 

ouc_system_stace .macninel_stace.hoid  :=f; 
out_3y stem_st ate .machinelstace. cur rent  :-2; 
out~syscem_scate .macnine2_state . inbuf fer ( 1 )  :»  Dl; 

out3sy3tem_stace .machine2_state . in_buf fer (2 )  :•  E; 

out~system_state  .mac.hine2_state  .pkt_rec  ( 1 )  :»  c; 

out_systom~state .machine2  state .pkt_rec (2 )  :»  f; 
elsif 

( ( in_system_3tate . mach ine l_sc ate . ack_rec ( 1) «t )  and 
( in~system_state .machine l_sc ace . ack_cec (2) -f )  and 
( in_system_state .machinelstace .hold  -  t)  and 
( in2syscem_state .machinel_scace .current  •  1)  and 
(in_system_state.GLOBAL_VABIABLES. CONTROL (1)  =  E)  and 
( in_syscem_stace . GL3BAL_VAR TABLES .CONTROL (2 )  -  A2)!  then 
out^system  state,  mach  me',  state,  ackrec  (1!  ;^f; 

ouC_syscem_state.machinel_state. ack_rec (2)  :=f; 
ouC_system_state  ..macn  inei  state. hold  :»f; 
out  _system_state  .  mach  me  Instate  .current  :  «2; 
out_system_scace.GLOBAL_VAHIABLES. CONTROL (1)  Al; 
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out_system_staCe.GL0BAL_VAfiIABLES.C0NTR0L(2)  E; 

else 


if  ((in  system  state  .machinel  state  .  aclc_rec  ( 1 )  *t )  and 
(in_sy3tem_state.GL0aAL_VARIABLES.DATA(2)  /-E)  )  then, 
out  system_state.machinel_state.hold  :•  t; 

elsif  (  {in~aystem_state  .machinel_state  .acic_rec  (1) -t )  and 
(in  system_state.machinel~state.ac!t_rec  (2) -f )  and 
(in_3y3tem_state.GL0BAI,_VARIABLES.DATA(2)-E)  )  then 
out_SYStem_state  .machinel_state  .ac)c_rec  ( 1)  :»  f; 

elsif  (  ( in_system_state  .machinel_state.aclc_rec  (1)  ”f )  and 
(in_system_state  .machinel_state  .ack_rec  (2)  -t )  ^  .id 
(in_system  state .machinel_state .hold  -  t))  then 

out_sy3tem_state.machinel_state.aclt  rec(2)  :•  f; 
out_3y3tem~state.machinel_state.hol3  f; 

else 

if  {  (in_system_state  .machinel_state  .aclc_rec  (1) -t  1  and 
(in_3y3tem_3tate  .machine l_state  .ac)t_rec  (2)  “t )  and 
(in_system  state .GL08AL_VARIABLES .DATA( 1)  “El  and 
(in_3y3tem~state. GLOBAL  VARIABLES .DATA (2 ) -E) )  then 
out  3ystem_state .macRinel_3tate .hold  f; 
out~system  state. machinel_state. ac)t_rec  (1)  :•  f; 

out  3ystem~state .machinel_state .ack_rec (2)  f; 
end  if;  ~ 
and  if; 

out  sy3tem_scate.machinel_state. Current  1; 

an3’  if; 

whan  others  »> 

put_line ( "There  is  an  error  in  the  Action  procedure”); 
end  case; 
end  Action; 


g 


) 


I 
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OUTPUT  FORMAT 


separate  (main) 

procedure  output_Gtuple (tuple  :  In  out  Gstate_cecord  type)  Is 
be^in  “ 

put(*  (•  i  integer' image (tuple .machinel_state . state_number) ) ; 
put (*  t  integer' image (tuple .machine2  state. state  number)); 
putC,'); 

put (tuple. machine 1  state. out  buffer (1).  width  •>  2); 
put{'*.'’); 

put (tuple.machlnel_state.out_buf fer (2) ,  width  ->  2); 
put  (*,*); 

put  (tuple.machinel_state.aclc  rec  ( 1) ,  width->l)  ; 
putC,-); 

put  (tuple .machinel  state. acic  rec(2),width->l); 
putC,'); 

put (tuple. machinel  state. hold.  width->l); 
putC.-); 

put (tuple. machine2_state. in_buffer ( 1) .  width  ->  2); 
put  (*,”); 

put (tuple. machine2  state. in  buffer (2).  width  ->  2); 
put(-.')  ; 

put  (tuple. machine2_state.p)ct_rec(l)  ,width”>l)  ; 
put  (","); 

put  (tuple .machine2  state. p)ct  rec  (2)  ,  width->l) ; 
putC*,'); 

put (tuple. GLOBAL  VARIABLES . DATA ( 1 ) ,  width  ->2); 
put('‘  •); 

put (tuple. GLOBAL_VARIABLES. DATA (2) ,  width  ->2) ; 
put  (•,')  ; 

put (tuple. GLOBAL  VARIABLES .CONTROL ( 1 ) ,  width  «>2); 
put(«,'); 

put (tuple. GLOBAL_VARIABLES. CONTROL (2) ,  width  ->2) ; 
put  ('•,');  ~  • 

put (tuple. machinel_state. current, width»>l) ; 
put(*  ]'); 
end  output_Gtuple; 

separate  (main) 

procedure  output_Gtuple_to_file (tuple  :  in  out  Gstate_record  type; 

counter  :  in  out  integer)  is” 

begin 

put (reach, counter) ; 

put (reach,'  (”  i  integer' image (tuple .raachinel_staCo . state  number)) 
put (reach, "  t  integer' image (tuple .machine2_state . state  number)); 
put  (reach, ','’)  ;  ~ 

put (reach, tuple .machinel_state .out_buffer (1) ,  width  •>  1); 
put (reach, *, ") ; 

put ( reach, tuple .machinel_3tate .out_buffec (2) ,  width  »>  1); 
put  (reach,  ",'’); 

put  (reach,  tuple  .machine l_st ate  .ac)c_cec  ( 1)  ,  width»>l)  ; 
put (reach, ', ') ; 

put (reach, tuple .machinel_ state .ack_ rec (2)  ,  width»>l ) ; 
put  (reach,  *,'*); 

put (teach, tuple .machine2_state . in_buf fer (1 ) ,  width  »>  1); 
put  (teach,  '',"); 

put (reach, tuple .machine2_state . in_buf fer (2) ,  width  »>  1); 
put ( reach, ", ')  ; 

put ( reach, tuple .machine2_state .pkt_cec(l),width=>l); 
put ( reach, ", ") ; 

put (roach, tuple .machine2_state . pkt_rec (2) , width»>l) ; 
put (reach, ",") ;  ” 

put (reach, tuple. GLOBAL_VARIABLES. OATA(l) ,  width  ->1); 
put (reach,"  )"); 
now_line ( reach) ; 
end  oucput_Gtuple_to_f ile; 

separate  (main) 

procedure  output_Gstate_node  (Gstate  pointer  :  in  out  Glinlt_type; 

Error_riag  :  in  out  boolean)  is 

begin 

output_l ine_count  :•  output  line_count  ♦  1; 
if  ( (output_L ine_count  mod  TO)  »  0)  then 
scrol l_pause; 


end  if; 

3et_col (Gcolumn_3et) ; 

put (G3tace_polnter.3ystem_3Cate_number,  width  ->  3); 
output_Gtuple (G3tate_pointer .Gtuple) ; 

if  ( (G3tate_pointer . linkl .Glink  »  null)  and  then  (Gstate_pointer . Iink2 .Glink  »  null) 
and  then 

(G3tate_pointer . links .Glink  «  null)  and  then  (G3tate_pointer . xink4 .Glink  »  null)) 
then  ~ 

Error_flag  :•  true; 

el3e 

Error_flag  falae; 
end  if; 

end  output_G3tate_node; 
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